carolsworld

detection-hackathon-apt29

Place for resources used during the Mordor Detection hackathon event featuring APT29 ATT&CK evals datasets

sysmon-config

Sysmon configuration file template with default high-quality event tracing

practicalthreathunting

Repository for Packt Practical Threathunting Book Resources

DAD

Log aggregation, analysis, alerting and correlation for Windows, Syslog and text based logs.

C2IntelFeeds

Automatically created C2 Feeds

threat-intel

Signatures and IoCs from public Volexity blog posts.

Purpleteam

Purpleteam scripts simulation & Detection - trigger events for SOC detections

awesome-lists

Awesome Security lists for SOC/CERT/CTI

ThreatHunting-Keywords-yara-rules

yara detection rules for hunting with the threathunting-keywords project

threat-INTel

Archive of publicly available threat INTel reports (mostly APT Reports but not limited to).

RedTeaming-Tactics-and-Techniques

Red Teaming Tactics and Techniques

Adaz

:wrench: Deploy customizable Active Directory labs in Azure - automatically.

attack_range

A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

AutomatedLab

AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts. It supports all Windows operating systems from 2008 R2 to 2022, some Linux distributions and various products like AD, Exchange, PKI, IIS, etc.

monkey

Infection Monkey - An open-source adversary emulation platform

surveyor

A cross-platform baselining, threat hunting, and attack surface analysis tool for security teams.

elastalert

Easy & Flexible Alerting With ElasticSearch

OSSEM-DM

OSSEM Detection Model

cti-python-stix2

OASIS TC Open Repository: Python APIs for STIX 2

cti-taxii-client

OASIS TC Open Repository: TAXII 2 Client Library Written in Python

sigma

Main Sigma Rule Repository

APTSimulator

A toolset to make a system look as if it was the victim of an APT attack

ATTACK-Python-Client

Python Script to access ATT&CK content available in STIX via a public TAXII server

commando-vm

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com

SilkETW

mimikatz

A little tool to play with Windows security

HELK

The Hunting ELK

OSSEM

Open Source Security Events Metadata (OSSEM)

msticpy

Microsoft Threat Intelligence Security Tools

cti-stix-common-objects

OASIS Cyber Threat Intelligence (CTI) TC: A repository for commonly used STIX objects in order to avoid needless duplication. https://github.com/oasis-open/cti-stix-common-objects