hillu

local-log4j-vuln-scanner

Simple local scanner for vulnerable log4j instances

go-yara

Go bindings for YARA

local-spring-vuln-scanner

Simple local scanner for applications containing vulnerable Spring libraries

go-ntdll

Go interface to NTDLL functions

edr-loadgen

Load generator for measuring overhead generated by EDRs and other logging tools on Linux

audit-documentation

Documentation and specifications

audit-userspace

Linux audit userspace repository

dumb-inject-rs

Simple DLL injection demo in Rust

go-splunk-client

Splunk REST API client

HandleKatz

PIC lsass dumper using cloned handles

laurel

Transform Linux Audit logs for SIEM usage

velociraptor-api-rs

Velociraptor API client in Rust

yara

The pattern matching swiss knife

apollon

Proof-of-Concept to evade auditd by writing /proc/PID/mem

augeas

A configuration editing tool and API

cplr

Piler for running C in the shell

gimphash

Imphash-like calculation on Golang binaries

Lsass-Shtinkering

lua-mode

Emacs major mode for editing Lua

misbrands

The world's most hated IT stickers

Neo23x0-audit-rules

Best Practice Auditd Configuration

pefile

pefile is a Python module to read and work with PE (Portable Executable) files

runner

The Runner for GitHub Actions :rocket:

smallstep-certificates

🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.

spyre

simple YARA-based IOC scanner

SysmonForLinux

velociraptor

Digging Deeper....

velociraptor-docs

Documentation site for Velociraptor

yara-memory-leak

yara rules test program

ZipExec

A unique technique to execute binaries from a password protected zip