rc-MikeDevens

VanillaWindowsReference

A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update. Use these CSVs to create your own known good hash sets!

S1QL-Queries

ForgeArmory

ForgeArmory provides TTPs that can be used with the TTPForge (https://github.com/facebookincubator/ttpforge).

TTPForge

The TTPForge is a Cybersecurity Framework for developing, automating, and executing attacker Tactics, Techniques, and Procedures (TTPs).

dfiq

DFIQ is a collection of investigative questions and the approaches for answering them

ACCD

Active C&C Detector

UACME

Defeating Windows User Account Control

ThreatHunting-Keywords

Awesome list of keywords and artifacts for Threat Hunting sessions

msrc-api

A collection of tools to interact with Microsoft Security Response Center API

handy-cti

Resources I've found useful for my CTI work

cheat

poor man's reference

CheatSheets

EVTX-ETW-Resources

Event Tracing For Windows (ETW) Resources

TheDefendersGuide

The Github project for The Defender's Guide by Luke Paine and Jonathan Johnson

IATelligence

IATelligence is a Python script that will extract the IAT of a PE file and request GPT to get more information about the API and the ATT&CK matrix related

at-ps

Adversary Tactics - PowerShell Training

IRM

Incident Response Methodologies 2022

Cobalt-Strike-CheatSheet

Some notes and examples for cobalt strike's functionality

AzureSentinelKQLScripts

Various tools used to monitor and troubleshoot Azure Sentinel data

DeimosC2

DeimosC2 is a Golang command and control framework for post-exploitation.

ScubaGear

Automation to assess the state of your M365 tenant against CISA's baselines

C2-JARM

A list of JARM hashes for different ssl implementations used by some C2/red team tools.

Havoc

The Havoc Framework.

Hunting-Queries-Detection-Rules

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

PersistenceSniper

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte

taskcafe

An open source project management tool with Kanban boards

MSRPC-to-ATTACK

A repository that maps commonly used attacks using MSRPC protocols to ATT&CK

MemProcFS

MemProcFS

rpcfirewall

Sentinel-Queries

Collection of KQL queries