Silv3rHorn

Sigma-Rules

A repository of my own Sigma detection rules.

osquery-defense-kit

Production-ready detection & response queries for osquery

varc

Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident.

elastic-container

Stand up a simple Elastic container with Kibana, Fleet, and the Detection Engine

trailscraper

A command-line tool to get valuable information out of AWS CloudTrail

tenzir

Open source security data pipelines.

mmk-ui-api

UI, API, and Scanner (Rules Engine) services for Merry Maker

volatility-docker

A suite of Volatility 3 plugins for memory forensics of Docker containers

EnableWindowsLogSettings

Documentation and scripts to properly enable Windows event logs.

AWSome-Pentesting

My cheatsheet notes to pentest AWS infrastructure

osintui

OSINT from your favorite services in a friendly terminal user interface - integrations for Virustotal, Shodan, and Censys

EvtxHussar

Initial triage of Windows Event logs

prefetch-hash-cracker

A small util to brute-force prefetch hashes

GHunt

🕵️‍♂️ Offensive Google framework.

canarytokens-docker

Docker configuration to quickly setup your own Canarytokens.

VanillaWindowsReference

A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update. Use these CSVs to create your own known good hash sets!

DFIR4vSphere

Powershell module for VMWare vSphere forensics

mlget

A golang CLI tool to download malware from a variety of sources.

GitFive

🐙 Track down GitHub users.

blackhat-arsenal-tools

Official Black Hat Arsenal Security Tools Repository

the-prime-hunt

A browser extension for threat hunting that provides one UI for different SIEMs/EDRs and simplifies investigation

aftermath

Aftermath is a free macOS IR framework

DeTTECT

Detect Tactics, Techniques & Combat Threats

dissect

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

DetectionLab

Automate the creation of a lab environment complete with security tooling and logging best practices

getsymbol

Simple tool to download debugging symbols from Microsoft, Google, Mozilla and Citrix symbol servers for reverse engineers compatible with Windows 8.1, 10 and 11

upx-recovery-tool

npm-initial-access

Easy to extend initial access scenario to help with EDR testing on Linux and Mac

EternalLiberty

dissect.cobaltstrike

Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles