ForensicITGuy

libpreloadvaccine

Whitelisting LD_PRELOAD libraries using LD_AUDIT

handy-cti

Resources I've found useful for my CTI work

forensicitguy.github.io

ForensicITGuy Blog

Invoke-PartyParrot

Bringing the Party Parrot to PowerShell

Find-Logons

PowerShell tool to lookup AD user info and track down account lockouts in AD domain

rhh-md5

Calculate the PE Rich Header MD5 hash

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

Clean-IISLogs

PowerShell tools to remove IIS logs according to retention policy

CSharp-RunPE

Hide malware behind a legit process C#

malware-analysis-tools

malware-analyst-crash-course

Malware Analyst Crash Course

clth-study-group

Scripts used for a Jupiter Broadcasting Command-Line Threat Hunting Study Group

golang-temperature-converter-cli

PSProfile

python-decoding-sensor-data

reverse-bytes

A simple Python 3 script to reverse the order of bytes in a file and write the result to a second.

salt-states

This repository maintains the SaltStack state files for the REMnux distro.

tools

Scripts and tools accompanying HP Threat Research blog posts and reports.

vscode-attack

Visual Studio Code extension for MITRE ATT&CK

yara

The pattern matching swiss knife