Carol's starred repositories
detection-hackathon-apt29
Place for resources used during the Mordor Detection hackathon event featuring APT29 ATT&CK evals datasets
sysmon-config
Sysmon configuration file template with default high-quality event tracing
practicalthreathunting
Repository for Packt Practical Threathunting Book Resources
C2IntelFeeds
Automatically created C2 Feeds
threat-intel
Signatures and IoCs from public Volexity blog posts.
Purpleteam
Purpleteam scripts simulation & Detection - trigger events for SOC detections
awesome-lists
Awesome Security lists for SOC/CERT/CTI
ThreatHunting-Keywords-yara-rules
yara detection rules for hunting with the threathunting-keywords project
threat-INTel
Archive of publicly available threat INTel reports (mostly APT Reports but not limited to).
RedTeaming-Tactics-and-Techniques
Red Teaming Tactics and Techniques
attack_range
A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk
AutomatedLab
AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts. It supports all Windows operating systems from 2008 R2 to 2022, some Linux distributions and various products like AD, Exchange, PKI, IIS, etc.
elastalert
Easy & Flexible Alerting With ElasticSearch
cti-python-stix2
OASIS TC Open Repository: Python APIs for STIX 2
cti-taxii-client
OASIS TC Open Repository: TAXII 2 Client Library Written in Python
APTSimulator
A toolset to make a system look as if it was the victim of an APT attack
ATTACK-Python-Client
Python Script to access ATT&CK content available in STIX via a public TAXII server
commando-vm
Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com
cti-stix-common-objects
OASIS Cyber Threat Intelligence (CTI) TC: A repository for commonly used STIX objects in order to avoid needless duplication. https://github.com/oasis-open/cti-stix-common-objects