
EventHorizon
Tool that gathers a customizable set of ETW telemetry and generates user-defined detections
defensive-toolseducationforensics+5
56

Tool that gathers a customizable set of ETW telemetry and generates user-defined detections

A Zeek package for the passive detection of "Ripple20" vulnerabilities in the Treck TCP/IP stack.

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

Best Practice Auditd Configuration

Blue Team detection lab created with Terraform and Ansible in Azure.

A repository of sysmon configuration modules

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…