Stars
KQL Queries. Microsoft Defender, Microsoft Sentinel
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
practical toolkit for cybersecurity and IT professionals. It features a detailed Linux cheatsheet for incident response
A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.
Suricata rules for network anomaly detection
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
A guide to using Azure Data Explorer and KQL for DFIR
MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
Rapidly Search and Hunt through Windows Forensic Artefacts
Starkiller is a Frontend for Empire.
BC-SECURITY / Empire
Forked from EmpireProject/EmpireEmpire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
Make your first side-channel attack on public datasets with eShard. This is a mirror of scared Gitlab repository. All contributions and merge request must be done through Gitlab project.
Standard collection of rules for capa: the tool for enumerating the capabilities of programs
Repository of YARA rules made by Trellix ATR Team
All in One OSCP Preparation Material
ELF file viewer/editor for Windows, Linux and MacOS.
A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
A curated list of the most important and useful resources about Threat Detection,Hunting and Intelligence.
HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.
Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, …
This project documents how to analyze cybersecurity data with machine learning tools and techniques in python. The tutorials run in Jupyter Notebooks and depend on the environment described in the …
Course materials for Modern Binary Exploitation by RPISEC
Xori is an automation-ready disassembly and static analysis library for PE32, 32+ and shellcode
A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.