Steven Dick's repositories
CEF-Syslog-Canary
A simple set of VBA scripts, AutoIT, and Powershell for Blue Team usage.
Security-CMPivots
Simple collection of threat hunting queries for SCCM CMPivot
Kerb-Canary
A powershell script to enumerate malformed Kerberos tickets(Gold/Silver/etc)
splunk_bonus_content
A collection of random Splunk content, mostly security or Enterprise Security focused
MITRE_SN_Tags
Import MITRE Tactics and Techniques as ServiceNow Security Tags
ArcSight-Sysmon-FlexConnector
Microfocus ArcSight FlexConnector for Microsoft Sysmon tool
atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
attack_data
A repository of curated datasets from various attacks
attack_range
A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk
HIBP-Parser
PowerShell based parser for HaveIBeenPwned.com JSON reports
prisma-cloud-compute-splunk
Splunk app for ingesting Prisma Cloud Compute incidents and forensics
security_content
Splunk Security Content
sigma
Generic Signature Format for SIEM Systems
sof-elk
Configuration files for the SOF-ELK VM, used in SANS FOR572
sysmon-modular
A repository of sysmon configuration modules