bfuzzy's repositories
auditd-attack
A Linux Auditd rule set mapped to MITRE's Attack Framework
ThreatHunter-Playbook
A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.
FuzzySysmon
My sysmon config I use for testing purposes
threat_hunting_tables
Theat hunting notes in flat file format and mapped to MITRE's ATT&CK IDs
threathunting-spl
Splunk code (SPL) useful for serious threat hunters.
Windows_Baselines
Windows Baselines
APTSimulator
A toolset to make a system look as if it was the victim of an APT attack
docker-bro
Bro IDS Dockerfile
PowerLessShell
Run PowerShell command without invoking powershell.exe
PowerShell-Suite
My musings with PowerShell
PyPowerShellXray
Python script to decode common encoded PowerShell scripts
search-guard
Search Guard is an Open Source Elasticsearch plugin that offers encryption, authentication, and authorisation.
Security-Data-Analysis
A series of labs that will help users apply various data science techniques to security related data.
sysmon-modular
A repository of sysmon configuration modules
Threat-Hunty-Stuff
Random Threat Hunting Stuff
Vega_Sankey
Vega Sankey
WinLogsZero2Hero
This is a repository from Adam Swan and I's presentation on Windows Logs Zero 2 Hero.