jreisdorffer Goto Github PK

aptsimulator

A toolset to make a system look as if it was the victim of an APT attack

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

attack-navigator

Web app that provides basic navigation and annotation of ATT&CK matrices

attack-python-client

Python Script to access ATT&CK content available in STIX via a public TAXII server

attack-tools

Utilities for MITRE™ ATT&CK

awesome-threat-detection

A curated list of awesome threat detection and hunting resources

caldera

An automated adversary emulation system

deviceguardbypassmitigationrules

A reference Device Guard code integrity policy consisting of FilePublisher deny rules for published Device Guard configuration bypasses

devopskit-docs

files

firuta

My collection of subscriptions / XPath filters for Windows Event Forwarding to detect possible badness

infosec_reference

An Information Security Reference That Doesn't Suck

invoke-attackapi

A PowerShell script to interact with the MITRE ATT&CK Framework via its own API

invoke-cradlecrafter

PowerShell Remote Download Cradle Generator & Obfuscator

invoke-obfuscation

PowerShell Obfuscator

krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

loki

Loki - Simple IOC and Incident Response Scanner

lolbas

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

microburst

A collection of scripts for assessing Microsoft Azure security

osquery

SQL powered operating system instrumentation, monitoring, and analytics.

ossem

Open Source Security Events Metadata (OSSEM)

poc

Proofs-of-concept

posh-cef

Powershell module for creating Common Event Format (CEF) messages that adhere to the CEF specification

powershell-dsc-for-linux

PowerShell Desired State Configuration - for Linux

psreflect

Easily define in-memory enums, structs, and Win32 functions in PowerShell

psreflect-functions

Module to provide PowerShell functions that abstract Win32 API functions

revoke-obfuscation

PowerShell Obfuscation Detection Framework

sysmon-config

Advanced Sysmon configuration, Installer & Auto Updater with high-quality event tracing

sysmon-modular

A repository of sysmon configuration modules

threathunter-playbook

A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.