Archived
EventLogging
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
defensive-toolsscripting-automationconfiguration-auditing+3
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
kolya5544/bearftpHoneypot FTP server written in .NET Core (C#) for both Linux and Windows.
mellow-hype/c2finderLook for un-sinkholed C&C IPs in your Bro logs (from Bambanek Consulting C&C master list)
michaelsanford/log4shell-honeypotDockerized honeypot for CVE-2021-44228.
mandiant/ioc-scanner-cve-2019-19781Indicator of Compromise Scanner for CVE-2019-19781
cisagov/check-your-pulseThis utility can help determine if indicators of compromise (IOCs) exist in the log files of a Pulse Secure VPN Appliance for CVE-2019-11510.
adamrpostjr/cve-2021-27065Quick One Line Powershell scripts to detect for webshells, possible zips, and logs.
alb-uss/secmonSECMON is a web-based tool for the automation of infosec watching and vulnerability management with a web interface.
0x0v1/audixAudix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring
grapl-security/graplGraph platform for Detection and Response
megamansec/ldap-monitoring-watchdogLDAP Watchdog: A real-time linux-compatible LDAP monitoring tool for detecting directory changes, providing visibility into additions, modifications,…
