SysmonSimulator
scarredmonk/sysmonsimulatorSysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and…
defensive-toolsincident-responselog-analysis
870
scarredmonk/sysmonsimulatorSysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and…
tonyphipps/meerkatA collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
0x4d31/honeylambdahoneyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS…
marcosd4h/memhunterLive hunting of code injection techniques
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
bartblaze/yara-rulesCollection of private Yara rules.
nextronsystems/sysmon-configProvides curated Sysmon event-tracing configuration templates for detecting Cobalt Strike, webshells, ransomware artifacts, and known exploit…
bushidouk/breach-report-collectionA collection of companies that disclose adversary TTPs after they have been breached
zdhenard42/soc-multitoolA powerful and user-friendly browser extension that streamlines investigations for security professionals.
microsoft/ics-forensics-toolsOpen-source forensics framework for analyzing Industrial PLC metadata and project files. Scans for suspicious artifacts in ICS environments to…
jpcertcc/malconfscanVolatility plugin for extracts configuration data of known malware
xephora/threat-remediation-scriptsThis repository contains a list of new remediation scripts.
rastrea2r/rastrea2rCollecting & Hunting for IOCs with gusto and style
3lp4tr0n/beaconhunterDetect and respond to Cobalt Strike beacons using ETW.
malvuln/ransomlordRansomLord is a proof-of-concept Anti-Ransomware exploitation tool that automates the creation of PE files, used to compromise ransomware…
viralmaniar/remote-desktop-caching-This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…
necr00/credential-huntingCredsHunter - Credential Hunting scripts for Windows and Linux OS
jepaynemsft/wefflesBuild a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI