#1Tools for blue team, defensive security, and threat protection.
Kitploit recommended
kiexitdispatcher/godefenderAnti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY.
mandiant/silketwC# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…
cloudflare/mitmengineA MITM (monster-in-the-middle) detection tool. Used to build MALCOLM:
idov31/functionstompingShellcode injection technique. Given as C++ header, standalone Rust program or library.
chryzsh/darthsidiousBuilding an Active Directory domain and hacking it
chronicle/gctiDetection signature repository providing YARA rules and threat-hunting content for identifying malware and malicious activity across enterprise…
hlldz/reflexxionRefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first…
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
foospidy/honeypyA low to medium interaction honeypot.
azuread/azure-ad-incident-response-powershell-moduleThe Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in…
didi/kemonAn Open-Source Pre and Post Callback-Based Framework for macOS Kernel Monitoring.
nbulischeck/tytonKernel-Mode Rootkit Hunter
jsa2/caopticsCA Optics - Azure AD Conditional Access Gap Analyzer
zecure/shadowdThe Shadow Daemon web application firewall server
cisagov/esxiargs-recoverA tool to recover from ESXiArgs ransomware
