invictus-ir Goto Github PK

alfa

ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework

aws-cheatsheet

A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.

aws_dataset

A dataset with CloudTrail events from an attack simulation using Stratus.

blue-team-app-office-365-and-azure

cobaltstrike

Collection of resources related to Cobalt Strike investigations

cyber-security-hub.github.io

Cyber Security Trainings

email-forwarding-rules

A mind map of email forwarding rule evidence in Microsoft 365

entra-apps

List of Microsoft Apps in Entra ID

gws_dataset

Google Workspace Audit logs containing several attacks

invictus-aws

invictus-training

Repository with supporting materials for Invictus Academy/Training

kql-threat-hunting-queries

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

kql_queries

KQL queries for Incident Response

macos

Repository for macOS related security research

microsoft-extractor-suite

A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.

o365_dataset

A dataset containing Office 365 Unified Audit Logs for security research and detection

office-365-extractor

The Office 365 Extractor is a tool that allows for complete and reliable extraction of the Unified Audit Log (UAL)

sigma-aws

This repository contains the research and components of our research into using Sigma for AWS Incident Response.

talks

An overview of our talks at security conferences