Defensive Tools

danielbohannon/invoke-cradlecrafter

PowerShell Remote Download Cradle Generator & Obfuscator

gossithedog/threathunting

Hunts for potential malware downloads and suspicious domain calls via common Windows LOLBins using YARA rules and Nexthink telemetry modules.

volexity/threat-intel

Signatures and IoCs from public Volexity blog posts.

fofapro/fapro

Multi-protocol honeypot simulator supporting 50+ network services with deep interaction, TCP/UDP/ICMP logging, JA3 fingerprinting, and virtual…

bfuzzy/auditd-attack

A Linux Auditd rule set mapped to MITRE's Attack Framework

qeeqbox/chameleon

19 Customizable honeypots for monitoring network traffic, bots activities and username\password credentials (DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3,…

sigmahq/pysigma

Python library to parse and convert Sigma rules into queries (and whatever else you could imagine)

thinkst/canarytokens-docker

Docker configuration to quickly setup your own Canarytokens.

danielbohannon/invoke-dosfuscation

Cmd.exe Command Obfuscation Generator & Detection Test Harness

northpolesec/santa

A binary and file access authorization system for macOS.

openedx/codejail

Secure code execution

dragokas/hijackthis

A free utility that finds malware, adware and other security threats

gendigitalinc/ioc

Threat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs.

mohuihui/antispy

AntiSpy is a free but powerful anti virus and rootkits toolkit.It offers you the ability with the highest privileges that can detect,analyze and…

danielbohannon/revoke-obfuscation

PowerShell Obfuscation Detection Framework

michenriksen/drawio-threatmodeling

Draw.io libraries for threat modeling diagrams