gs3cl's repositories
KapeFiles
This repository serves as a place for community created Targets and Modules for use with KAPE.
hayabusa
Hayabusa is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs written in Rust.
WELA
WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）
SysmonSimulator
Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams.
APTSimulator
A toolset to make a system look as if it was the victim of an APT attack
awesome-incident-response
A curated list of tools for incident response
vscode-sysmon
Visual Studio Code Microsoft Sysinternal Sysmon configuration file extension.
DFIRMindMaps
A repository of DFIR-related Mind Maps geared towards the visual learners!
EVTX-ATTACK-SAMPLES
Windows Events Attack Samples
EVTX-to-MITRE-Attack
Set of EVTX samples (>170) mapped to MITRE Att@k tactic and techniques to measure your SIEM coverage or developed new use cases.
sysmon-config
Sysmon configuration file template with default high-quality event tracing
KAPE-EZToolsAncillaryUpdater
A script that updates KAPE (using Get-KAPEUpdate.ps1) as well as EZ Tools (within .\KAPE\Modules\bin) and the ancillary files that enhance the output of those tools
Awesome-KAPE
A curated list of KAPE-related resources
sigma
Generic Signature Format for SIEM Systems
laurel
Transform Linux Audit logs for SIEM usage
caldera
Automated Adversary Emulation Platform
Zircolite
A standalone SIGMA-based detection tool for EVTX.
hollows_hunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Awesome-CobaltStrike-Defence
Defences against Cobalt Strike
APT-Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
chainsaw
Rapidly Search and Hunt through Windows Event Logs
ForensicImageKAPEOutput
A repository of output using KAPE (!EZParser Module) for various publicly available forensic images freely available!
dfirt
Collect information of Windows PC when doing incident response
DFIR
Incident response teams usually working on the offline data, collecting the evidence, then analyze the data
