SysmonSimulator
scarredmonk/sysmonsimulatorSysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and…
defensive-toolsincident-responselog-analysis
scarredmonk/sysmonsimulatorSysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and…
corelight/cve-2021-42292Zeek package detecting CVE-2021-42292 Microsoft Excel local privilege escalation exploit via network traffic analysis of spreadsheet downloads.
mingchen-script/cve-2020-1472-visualizerPowerShell script to scan Windows Event Logs for CVE-2020-1472 indicators (events 5827-5831), export to CSV, and generate Excel pivot tables for…
laresllc/cve-2021-1675CVE-2021-1675 Detection Info
hackinglz/panrapidcheckExtract useful information from PANOS support file for CVE-2024-3400
ahmedkhlief/apt-hunterAPT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of…
duggytuxy/data-shield_ipv4_blocklistCurated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
tonyphipps/meerkatA collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
xephora/threat-remediation-scriptsThis repository contains a list of new remediation scripts.
viralmaniar/remote-desktop-caching-This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…
wiz-sec-public/wiz-research-iocsCurated public database of indicators of compromise aggregated by Wiz Research for threat detection, hunting, and incident response workflows.
hybridbrothers/hunting-queries-detection-rulesThe purpose of this repository is to share KQL queries to help identify security misconfigurations, hunt for specific patterns, or detect malicious…
sap8899/reportlyAzureAD/EntraID user activity reporter for blue teams. Input a suspicious user and time frame to receive a detailed report of user info, actions, and…
fireeye/cve-2021-44228OpenIOC rules to facilitate hunting for indicators of compromise
citrix/ioc-scanner-cve-2019-19781Indicator of Compromise Scanner for CVE-2019-19781
reddrip7/log4shell_cve-2021-44228_related_attacks_iocsCurated repository of Indicators of Compromise (IOCs), attack source IPs, and Snort/Suricata detection rules for Log4Shell (CVE-2021-44228) attacks.