EntraTrace
bert-janp/entratraceDefensive research tool that documents observable API endpoints and user agents of offensive tooling targeting Microsoft Entra ID, supporting…
authenticationcloud-securitydefensive-tools+5
122
bert-janp/entratraceDefensive research tool that documents observable API endpoints and user agents of offensive tooling targeting Microsoft Entra ID, supporting…
letlaka/redsun-bluehammer-undefend-detection-packMicrosoft Defender XDR KQL detections for RedSun, BlueHammer, UnDefend, and CVE-2026-33825-related Defender abuse behaviors.
olafhartong/sysmon-modularA repository of sysmon configuration modules
cyb3rmik3/kql-threat-hunting-queriesA repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
nccgroup/windowsmempagedeltaA Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection
chpratik/cve-2026-54121Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
dobybaxter127/nimbus-vestigeA forensic reconstruction engine for cloud and identity incident response.
blacksnufkin/invoke-dumpmdeconfigPowerShell script to dump Microsoft Defender Config, protection history and Exploit Guard Protection History (no admin privileges required )
cyprianatsyor/letsdefend-cve-2022-41082-exploitation-attemptDetailed incident report and educational analysis of CVE-2022-41082 (ProxyNotShell) exploitation attempt on Microsoft Exchange Server, including…
maikelnight/zerologonCheck for events that indicate non compatible devices -> CVE-2020-1472
zh54321/sharepointdumperPowerShell SharePoint extraction + auditing tool for red/blue/purple teams. Enumerates all SharePoint sites/drives a user can access via Microsoft…
lnfernux/log-horizonMicrosoft Sentinel SIEM Log Source Analyzer
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
cameloo1/sharepoint-toolshell-micro-postmortemReproducible incident micro-postmortem for on-prem Microsoft SharePoint “ToolShell” (CVE-2025-53770): ATT&CK snapshot, “logs that matter” table,…
azure/azure-sentinelCloud-native SIEM for intelligent security analytics for your entire enterprise.
airbus-cert/winsharkA wireshark plugin to instrument ETW
jangeisbauer/gundoggundog - guided hunting in Microsoft Defender
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.