benjeems

sigma

Main Sigma Rule Repository

cve-2021-44228

Log4j Exploit Detection Logic for Zeek

Certify

Active Directory certificate abuse.

ForgeCert

"Golden" certificates

DetectionLab

Automate the creation of a lab environment complete with security tooling and logging best practices

sliver

Adversary Emulation Framework

sunburst_countermeasures

CVE-2020-16898

A network detection package for CVE-2020-16898 (Windows TCP/IP Remote Code Execution Vulnerability)

CVE-2020-1350-DoS

A denial-of-service proof-of-concept for CVE-2020-1350

zui

Zui is a powerful desktop application for exploring and working with data. The official front-end to the Zed lake.

zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Venator

[⛔️ Deprecated] Venator is a python tool used to gather data for proactive detection of malicious activity on macOS devices.

hassh

HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of a small MD5 fingerprint.

hassh-utils

hassh-utils: Nmap NSE Script and Docker image for HASSH - the SSH client/server fingerprinting method (https://github.com/salesforce/hassh)