BlueTeam-Tools

This github repository contains a collection of 70+ tools and resources that can be useful for blue teaming activities.

Some of the tools may be specifically designed for blue teaming, while others are more general-purpose and can be adapted for use in a blue teaming context.

🔗 If you are a Red Teamer, check out RedTeam-Tools

Warning

The materials in this repository are for informational and educational purposes only. They are not intended for use in any illegal activities.

Note

Hide Tool List headings with the arrow.

Click 🔙 to get back to the list.

Tool List

Blue Team Tips 5 tips

• Payload extraction with Process Hacker @embee_research
• Prevent Script Execution via Double Click Default Application GPO Change
• Detect Cryptojacking Malware with Proxy Logs Dave Mckay
• Remove null bytes in CyberChef malware analysis @Securityinbits
• Recover scrubbed metadata from a PDF @flakpaket

Network Discovery and Mapping 6 tools

• Nmap Network scanner
• Nuclei Vulnerability scanner
• Masscan Fast network scanner
• Angry IP Scanner IP/port scanner
• ZMap Large network scanner
• Shodan Internet facing asset search engine

Vulnerability Management 5 tools

• OpenVAS Open-source vulnerability scanner
• Nessus Essentials Vulnerability scanner
• Nexpose Vulnerability management tool
• HackerOne Bug Bounty Management Platform
• Lynis Security auditing tool for Linux, macOS, and UNIX

Security Monitoring 11 tools

• Sysmon System Monitor for Windows
• Kibana Data visualization and exploration
• Logstash Data collection and processing
• parsedmarc Email DMARC data visualisation
• Phishing Catcher Phishing catcher using Certstream
• maltrail Malicious traffic detection system
• AutorunsToWinEventLog Windows AutoRuns Event Parser
• procfilter YARA-integrated process denial framework
• velociraptor Endpoint visibility and collection tool
• SysmonSearch Sysmon event log visualisation
• Canary Tokens Deception honeypot documents

Threat Tools and Techniques 12 tools

• lolbas-project.github.io Living Off The Land Windows Binaries
• gtfobins.github.io Living Off The Land Linux Binaries
• filesec.io Attacker file extensions
• KQL Search KQL query aggregator
• Unprotect Project Malware evasion techniques knowledge base
• chainsaw Fast Windows Forensic Artefacts Searcher
• freq Domain generation algorithm malware detection
• yarGen YARA rule generator
• EmailAnalyzer Suspicious emails analyser
• VCG Code security scanning tool
• CyberChef GCHQ online data manipulation platform
• PersistenceSniper Find implants on Windows machines

Threat Intelligence 4 tools

• Maltego Threat Intelligence Platform
• MISP Malware Information Sharing Platform
• ThreatConnect Threat data aggregation
• Adversary Emulation Library An open library of adversary emulation plans

Incident Response Planning 5 tools

• NIST Cybersecurity Framework
• Incident Response Plan Framework for incident response
• Ransomware Response Plan Framework for ransomware response
• Incident Response Reference Guide Incident preparation guidance paper
• Awesome Incident Response List of tools for incident response