Silv3rHorn

vulhub

Pre-Built Vulnerable Environments Based on Docker-Compose

cvemap

Navigate the CVE jungle with ease.

API-s-for-OSINT

List of API's for gathering information about phone numbers, addresses, domains etc

BestEdrOfTheMarket

Little user-mode AV/EDR evasion lab for training & learning purposes

redress

Redress - A tool for analyzing stripped Go binaries

Locksmith

A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.

KubeHound

Kubernetes Attack Graph

raven

CI/CD Security Analyzer

MasterParser

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

shell-backdoor

all shell backdoor in the world

awskillswitch

Lambda function that streamlines containment of an AWS account compromise

CVE-Half-Day-Watcher

managed-kubernetes-auditing-toolkit

All-in-one auditing toolkit for identifying common security issues in managed Kubernetes environments. Currently supports Amazon EKS.

AD-Canaries

The purpose of this project is to publish and maintain the deployment PowerShell script that automates deployments for Active Directory Canary objects.

YAMA

Yet Another Memory Analyzer for malware detection

IndicatorOfCanary

Canary Detection

SWAT

Simple Workspace Attack Tool (SWAT) is a tool for simulating malicious behavior against Google Workspace in reference to the MITRE ATT&CK framework.

PowerDecode

PowerDecode is a PowerShell-based tool that allows to deobfuscate PowerShell scripts obfuscated across multiple layers. The tool performs code dynamic analysis, extracting malware hosting URLs and checking http response.It can also detect if the malware attempts to inject shellcode into memory.

Monocle

Tooling backed by an LLM for performing natural language searches against compiled target binaries. Search for encryption logic, password strings, vulnerabilities, etc.

RMML

A list of RMMs designed to be used in automation to build alerts

aws-security-services-best-practices

YARA_Detection_Engineering

Detection Engineering with YARA

DefenderHarvester

Expose a lot of MDE telemetry that is not easily accessible in any searchable form

SigmAIQ

A pySigma wrapper and langchain toolkit for automatic rule creation/translation

MetadataPlus

A tool to use novel locations to extract metadata from Office documents.

machofile

machofile is a module to parse Mach-O binary files

detections

Magnet-RESPONSE-PowerShell

PowerShell scripts for running Magnet RESPONSE forensic collection tool in large enterprises.

parseusbs

Parses USB connection artifacts from offline Registry hives

ccl-segb

Module(s) related to reading SEGB (fka "Biome") data from iOS, mascOS, etc.