Johan Selnes's starred repositories
ProgrammingMicrosoftSentinel
Programming Microsoft Sentinel book
aws-cheatsheet
A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.
SentinelAutomationModules
The Microsoft Sentinel Triage AssistanT (STAT) enables easy to create incident triage automation in Microsoft Sentinel
awesome-detection-rules
This is a collection of threat detection rules / rules engines that I have come across.
PayloadsAllTheThings
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
awesome-detection-engineering
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
DFIRMindMaps
A repository of DFIR-related Mind Maps geared towards the visual learners!
Sentinel-Queries
Collection of KQL queries
public-pentesting-reports
A list of public penetration test reports published by several consulting firms and academic security groups.
PrivescCheck
Privilege Escalation Enumeration Script for Windows
aws-cloudsaga
AWS CloudSaga - Simulate security events in AWS
awesome-threat-detection
✨ A curated list of awesome threat detection and hunting resources 🕵️♂️
AWS-Threat-Simulation-and-Detection
Playing around with Stratus Red Team (Cloud Attack simulation tool) and SumoLogic
security-study-plan
Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...
blocklists
Shared lists of problem domains people may want to block with hosts files
Azure-Sentinel
Cloud-native SIEM for intelligent security analytics for your entire enterprise.
MustLearnKQL
Code included as part of the MustLearnKQL blog series
Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
AzureADAssessment
Tooling for assessing an Azure AD tenant state and configuration
Azure-AD-Incident-Response-PowerShell-Module
The Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in conjunction with the Microsoft Detection and Response Team (DART), to assist in compromise response.
TeamFiltration
TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts