Sharky-Rod

sigma

Main Sigma Rule Repository

ImportExcel

PowerShell module to import/export Excel spreadsheets, without Excel

fleet

fleet ties together systemd and etcd into a distributed init system

EVTX-ATTACK-SAMPLES

Windows Events Attack Samples

pyt

A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications

PSScriptAnalyzer

Download ScriptAnalyzer from PowerShellGallery

sof-elk

Configuration files for the SOF-ELK VM

fleet

A flexible control server for osquery fleets

ecs

Elastic Common Schema

rdpscan

A quick scanner for the CVE-2019-0708 "BlueKeep" vulnerability.

mac_apt

macOS (& ios) Artifact Parsing Tool

PSWinReporting

This PowerShell Module has multiple functionalities, but one of the signature features of this module is the ability to parse Security logs on Domain Controllers providing easy to use access to AD Events.

OrgKit

Provision a brand-new company with proper defaults in Windows, Offic365, and Azure

ir-rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

SwiftFilter

Exchange Transport rules to detect and enable response to phishing

MacForensics

Scripts to process macOS forensic artifacts

ip4r

ip4r current and new development

fleetspeak

PSWinDocumentation.AD

PowerShell module delivering a lot of Active Directory Forest/Domain information

Dashimo

Dashimo is very simple, intuitive PowerShell generated HTML file. That's right. A single, static HTML file that you can send to email or host on a website.

evt2sigma

Log Entry to Sigma Rule Converter

macMRU-Parser

Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format.

LOCKLEVEL

A prototype that demonstrates a method for scoring how well Windows systems have implemented some of the top 10 Information Assurance mitigation strategies. #nsacyber

assimilate

Assimilate is a series of scripts for using the Naïve Bayes algorithm to find potential malicious activity in HTTP headers

Mac-Locations-Scraper

macOS/iOS database location scraper to extract location data

Emailimo

Small project that simplifies (according to me) sending colorful emails in PowerShell

CBIRAutomation

CB API scripts for IR, administration, etc.

Documentimo

This PowerShell module allows you to create Microsoft Word documents without Word being installed on the machine

Excelimo

cbr-mass-acquire

This script enables responders and analysts to use Carbon Black Response to perform mass file acquisitions across all endpoints or a targeted list of endpoints.