EntraTrace
bert-janp/entratraceDefensive research tool that documents observable API endpoints and user agents of offensive tooling targeting Microsoft Entra ID, supporting…
authenticationcloud-securitydefensive-tools+5
122
bert-janp/entratraceDefensive research tool that documents observable API endpoints and user agents of offensive tooling targeting Microsoft Entra ID, supporting…
azure/azure-sentinelCloud-native SIEM for intelligent security analytics for your entire enterprise.
microsoft/msticpyMicrosoft Threat Intelligence Security Tools
microsoft/procdump-for-linuxA Linux version of the ProcDump Sysinternals tool
dobybaxter127/nimbus-vestigeA forensic reconstruction engine for cloud and identity incident response.
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
lnfernux/log-horizonMicrosoft Sentinel SIEM Log Source Analyzer
microsoft/avmlPortable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote…
olafhartong/sysmon-modularA repository of sysmon configuration modules
dfir-orc/dfir-orcForensics artefact collection tool for systems running Microsoft Windows
ethan-andrews/exploitarium-detectionsKQL detection rules for Microsoft Sentinel and Defender XDR covering the bikini/exploitarium anonymous disclosure — a personal research archive of…
osbornepro/btps-secpackPowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…
h4cknain/cve-2024-21413-microsoft-outlook-moniker-link-vulnerabilityLab write-up analyzing CVE-2024-21413 Outlook Moniker Link exploitation, NetNTLMv2 credential leakage via SMB, detection with YARA/Wireshark, and…
chpratik/cve-2026-54121Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
chpratik/cve-2026-50522Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
kaandemir993/vidar-stealer-reverse-engineering"In-depth reverse engineering analysis of Vidar Stealer 2.0 covering Task Scheduler tampering (1999 timestamps), Explorer.exe process hollowing, and…
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
letlaka/redsun-bluehammer-undefend-detection-packMicrosoft Defender XDR KQL detections for RedSun, BlueHammer, UnDefend, and CVE-2026-33825-related Defender abuse behaviors.