bfuzzy Goto Github PK

aptsimulator

A toolset to make a system look as if it was the victim of an APT attack

auditd-attack

A Linux Auditd rule set mapped to MITRE's Attack Framework

crave

Framework to automatically test and explore the capabilities of generic AV engines

docker-bro

Bro IDS Dockerfile

fuzzysysmon

My sysmon config I use for testing purposes

grouper

A PowerShell script for helping to find vulnerable settings in AD Group Policy.

helk

The Hunting ELK

mac4n6

Collection of forensics artifacs location for Mac OS X and iOS

ossem

Open Source Security Events Metadata (OSSEM)

powerlessshell

Run PowerShell command without invoking powershell.exe

powershell-suite

My musings with PowerShell

pypowershellxray

Python script to decode common encoded PowerShell scripts

search-guard

Search Guard is an Open Source Elasticsearch plugin that offers encryption, authentication, and authorisation.

security-data-analysis

A series of labs that will help users apply various data science techniques to security related data.

skadi

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

soc_stuff

srdi

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

sysmon-modular

A repository of sysmon configuration modules

threat-hunty-stuff

Random Threat Hunting Stuff

threat_hunting_tables

Theat hunting notes in flat file format and mapped to MITRE's ATT&CK IDs

threathunter-playbook

A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.

threathunting-spl

Splunk code (SPL) useful for serious threat hunters.

vega_sankey

Vega Sankey

whids

windows-hunting

windows_baselines

Windows Baselines

winlogszero2hero

This is a repository from Adam Swan and I's presentation on Windows Logs Zero 2 Hero.