cve-2025-24054-lab
t0tooro/cve-2025-24054-labBlue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy
authenticationconfiguration-auditingeducation+7
t0tooro/cve-2025-24054-labBlue-team lab: detecting & mitigating CVE-2025-24054 (Windows NTLM hash disclosure) with Sysmon, Wazuh SIEM, and Group Policy
antonlovesdnb/sysmonconfigpusher2Web-based tool for managing and deploying Sysmon configurations across Windows endpoints via agentless (WMI/SMB) or agent-based methods, with remote…
osbornepro/btps-secpackPowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
arisharazakhan-cpu/dod-blue-team-network-labHigh fidelity defensive security lab simulating a DoD aligned enterprise network with Active Directory, VLAN segmentation, STIG based hardening,…
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
olafhartong/sysmon-parserAutomatically generated Sysmon parser for Azure Sentinel
scarredmonk/sysmonsimulatorSysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and…
olafhartong/sysmon-modularA repository of sysmon configuration modules
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
iomoath/filewatchtowerFWT is a security analysis and file monitoring tool that utilizes Sysmon events.
manishrawat21/detection-rulesThis repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual…
karitamw/printnightmare-detection-mitigation-labSanitised Windows security lab demonstrating Active Directory administration, host and network detection, and layered mitigation of CVE-2021-34527.
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
nextronsystems/sysmon-configSysmon configuration file template with default high-quality event tracing
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…
tsale/edr-telemetryThis project aims to compare and evaluate the telemetry of various EDR products.