Tools

inverse-inc/packetfence

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…

corazawaf/coraza

Go-based Web Application Firewall library compatible with ModSecurity SecLang rules and OWASP Core Rule Set v4, providing real-time HTTP traffic…

olafhartong/sysmon-modular

A repository of sysmon configuration modules

spiderlabs/owasp-modsecurity-crs

OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)

googleprojectzero/sandbox-attacksurface-analysis-tools

Set of tools to analyze Windows sandboxes for exposed attack surface.

sap/macos-enterprise-privileges

This application gives Mac users in enterprise environments control over the administration of their machines by elevating their access level to…

neo23x0/auditd

Best Practice Auditd Configuration

globaleaks/globaleaks-whistleblowing-software

GlobaLeaks is a free and open-source whistleblowing software enabling anyone to easily set up and maintain a secure reporting platform.

ossf/allstar

GitHub App to set and enforce security policies

bfuzzy/auditd-attack

A Linux Auditd rule set mapped to MITRE's Attack Framework

itm4n/pplcontrol

Windows tool to list, get, set, protect, and unprotect process protection levels (PP/L) for debugging, inspection, and privilege escalation.

sublime-security/sublime-rules

Open-source YAML rule set for detecting and preventing email attacks including BEC, credential phishing, malware, and supporting threat hunting.

twosevenonet/edrchoker

A tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server.

huntandhackett/concealed_code_execution

Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows

eclecticiq/opentaxii

TAXII server implementation in Python from EclecticIQ

op7ic/blueteam.lab

Blue Team detection lab created with Terraform and Ansible in Azure.

olafhartong/mde-auditcheck

MDE relies on some of the Audit settings to be enabled

hullabrian/eventhorizon

Tool that gathers a customizable set of ETW telemetry and generates user-defined detections