Silv3rHorn

Monocle

Tooling backed by an LLM for performing natural language searches against compiled target binaries. Search for encryption logic, password strings, vulnerabilities, etc.

detections

vulhub

Pre-Built Vulnerable Environments Based on Docker-Compose

IndicatorOfCanary

Canary Detection

cvemap

Navigate the CVE jungle with ease.

Locksmith

A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.

aws-security-services-best-practices

MasterParser

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

YARA_Detection_Engineering

Detection Engineering with YARA

ccl-segb

Module(s) related to reading SEGB (fka "Biome") data from iOS, mascOS, etc.

MetadataPlus

A tool to use novel locations to extract metadata from Office documents.

DefenderHarvester

Expose a lot of MDE telemetry that is not easily accessible in any searchable form

AD-Canaries

The purpose of this project is to publish and maintain the deployment PowerShell script that automates deployments for Active Directory Canary objects.

awskillswitch

Lambda function that streamlines containment of an AWS account compromise

RMML

A list of RMMs designed to be used in automation to build alerts

SigmAIQ

BestEdrOfTheMarket

Little user-mode AV/EDR evasion lab for training & learning purposes

CVE-Half-Day-Watcher

redress

Redress - A tool for analyzing stripped Go binaries

raven

CI/CD Security Analyzer

parseusbs

Parses USB connection artifacts from offline Registry hives

PowerDecode

PowerDecode is a PowerShell-based tool that allows to deobfuscate PowerShell scripts obfuscated across multiple layers. The tool performs code dynamic analysis, extracting malware hosting URLs and checking http response.It can also detect if the malware attempts to inject shellcode into memory.

API-s-for-OSINT

List of API's for gathering information about phone numbers, addresses, domains etc

machofile

machofile is a module to parse Mach-O binary files

KubeHound

Kubernetes Attack Graph

Magnet-RESPONSE-PowerShell

PowerShell scripts for running Magnet RESPONSE forensic collection tool in large enterprises.

SWAT

Simple Workspace Attack Tool (SWAT) is a tool for simulating malicious behavior against Google Workspace in reference to the MITRE ATT&CK framework.

YAMA

Yet Another Memory Analyzer for malware detection

managed-kubernetes-auditing-toolkit

All-in-one auditing toolkit for identifying common security issues in managed Kubernetes environments. Currently supports Amazon EKS.

shell-backdoor

all shell backdoor in the world