Tools

adrecon/adrecon

PowerShell tool that extracts Active Directory artifacts via LDAP or ADWS and generates Excel reports for auditing, DFIR, and penetration testing.

joeavanzato/trawler

PowerShell script helping Incident Responders discover potential adversary persistence mechanisms.

zedocun/soc-investigation-powershell-edrfreeze

SOC investigation of CVE-2024-49138 exploitation alert involving PowerShell, EDRFreeze execution, and defense evasion behavior in a simulated…

clong/detectionlab

Automate the creation of a lab environment complete with security tooling and logging best practices

n0dec/malwless

Test Blue Team detections without running any attack.

yamato-security/enablewindowslogsettings

Documentation and scripts to properly enable Windows event logs.

sumidcyber/zeroscout

🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…

ion-storm/sysmon-config

Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…

securitybrewery/catalyst

Self-hosted incident response platform with ticket management, automated reaction playbooks, task tracking, and dashboards for streamlining alert…

dfir-orc/dfir-orc

Forensics artefact collection tool for systems running Microsoft Windows

mthcht/threathunting-keywords

Awesome list of keywords and artifacts for Threat Hunting sessions

iknowjason/bluecloud

Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.

lolbas-project/lolbas

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

zeek/zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

olafhartong/sysmon-modular

A repository of sysmon configuration modules

withsecurelabs/chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

stanfrbd/cyberbro

A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.