
ketshash
A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.
authenticationdefensive-toolsincident-response+3
168

A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.

This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…

A powerful and flexible tool to apply active attacks for disrupting stegomalware

Interactive data visualization tool for blue teams to analyze detection data, understand relationships, reduce alert fatigue, and improve incident…

A MITM (monster-in-the-middle) detection tool. Used to build MALCOLM:

Detect and respond to Cobalt Strike beacons using ETW.