#1Tools for blue team, defensive security, and threat protection.
Kitploit recommended
spiderlabs/owasp-modsecurity-crsOWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)
mozilla/mozdefDEPRECATED - MozDef: Mozilla Enterprise Defense Platform
optiv/mangleMangle is a tool that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRs
accenture/spartacusSpartacus DLL/COM Hijacking Toolkit
kiexitdispatcher/godefenderAnti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY.
mandiant/silketwC# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…
cloudflare/mitmengineA MITM (monster-in-the-middle) detection tool. Used to build MALCOLM:
idov31/functionstompingShellcode injection technique. Given as C++ header, standalone Rust program or library.
chryzsh/darthsidiousBuilding an Active Directory domain and hacking it
chronicle/gctiDetection signature repository providing YARA rules and threat-hunting content for identifying malware and malicious activity across enterprise…
hlldz/reflexxionRefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first…
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
foospidy/honeypyA low to medium interaction honeypot.
azuread/azure-ad-incident-response-powershell-moduleThe Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in…
didi/kemonAn Open-Source Pre and Post Callback-Based Framework for macOS Kernel Monitoring.
