
masq
Live recon and posture auditing for AI agent infrastructure: scans MCP configs, session logs, and APIs for secrets, poisoned catalogs, and CoT leaks.

Live recon and posture auditing for AI agent infrastructure: scans MCP configs, session logs, and APIs for secrets, poisoned catalogs, and CoT leaks.

A script that helps you understand why your E-Mail ended up in Spam

Parses Apple Unified Logs to extract process, thread, activity, timestamp, and message metadata from logarchives or live macOS systems into JSONL/CSV…

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to…

Python library to parse and convert Sigma rules into queries (and whatever else you could imagine)

GitHub mirror of the Linux Kernel's audit repository

Ruby On Rails Application For Network Security Monitoring

USB HID driver emulation with PID/VID (0x3bca/0x27bb) of Plenom A/S Busylight Alpha, that is supported by Mimikatz. When mimikatz is executed, a…

The Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent to or from…

A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection


A Bro package to identify connections that are bursting (lots of data and transferring quickly).

Zeek Log Cheatsheets

Zeek package for tracking long connections to report them before they have completed.

Bro analyzer that detects Google's QUIC protocol

A Zeek OpenVPN protocol analyzer, based on Spicy.

Mapping Corelight or Zeek data to Elastic Common Schema logs

Mapping Corelight or Zeek data to Elastic Common Schema fields