nicktrogdon Goto Github PK

active-directory-exploitation-cheat-sheet

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

active-directory-exploitation-cheat-sheet-1

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

ad-attack-defense

Attack and defend active directory using modern post exploitation adversary tradecraft activity

ad-attackdefend

For Glory

adrecon

ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.

apt-hunter

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

aurora-incident-response

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders

avml

AVML - Acquire Volatile Memory for Linux

awesome-hacking

A collection of various awesome lists for hackers, pentesters and security researchers

catalyst

Catalyst is an open source SOAR system that helps to automate alert handling and incident response processes

cdqr

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices

chainsaw

Rapidly Search and Hunt through Windows Event Logs

cortex

Cortex: a Powerful Observable Analysis and Active Response Engine

deepbluecli

dfirtrack

DFIRTrack - The Incident Response Tracking Application

evolve

Web interface for the Volatility Memory Forensics Framework

fibratus

A modern tool for the Windows kernel exploration and tracing

flare-vm

grr

GRR Rapid Response: remote live forensics for incident response

hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

hoarder

This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.

invisi-shell

Hide your Powershell script in plain sight. Bypass all Powershell security features

irm

Incident Response Methodologies

kuiper

Digital Forensics Investigation Platform

logontracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log

loki

Loki - Simple IOC and Incident Response Scanner

malconfscan

Volatility plugin for extracts configuration data of known malware

meerkat

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

orochi

The Volatility Collaborative GUI

payloadsallthethings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF