A collection of threat hunting and detection engineering Jupyter notebooks accompanying the Weekly Purple Team YouTube channel. Each notebook provides detection logic to help security professionals understand both offensive techniques and defensive strategies.
☆17Feb 27, 2026Updated 4 months ago
Alternatives and similar repositories for ThreatHunting-JupyterNotebooks
Users that are interested in ThreatHunting-JupyterNotebooks are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A Python based tool to convert custom queries from Legacy BloodHound to BloodHound CE format, with the option to directly upload them to …☆38Oct 1, 2025Updated 9 months ago
- ☆16Jun 24, 2025Updated last year
- A stealthier approach to WMI-based command execution using Impacket without touching the disk.☆86Mar 15, 2026Updated 4 months ago
- Run CobaltStrike aggressorscript over TCP☆15Feb 9, 2026Updated 5 months ago
- Modular User-Defined Reflective Loader (UDRL) built on Crystal Palace for controlled DLL execution and evasion research.☆34Apr 14, 2026Updated 3 months ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- inspired by mr d0x filefix☆16Feb 4, 2026Updated 5 months ago
- One PsExec client to rule them all☆15Mar 25, 2026Updated 3 months ago
- Impersonate Windows tokens in Nim☆24Aug 4, 2025Updated 11 months ago
- rust port of pspy with support for process monitoring over dbus☆38Jan 4, 2026Updated 6 months ago
- Comprehensive Active Directory Enumeration tool using Netexec☆19Dec 27, 2025Updated 6 months ago
- Cobalt Strike BOF to obtain location data☆26Jul 4, 2026Updated 2 weeks ago
- ☆20Mar 3, 2026Updated 4 months ago
- Combining KslDump and GhostKatz to dump LSASS using no-fix KslD.sys memory read to bypass PPL. Extracts MSV1_0 NT hashes and WDigest clea…☆45Mar 27, 2026Updated 3 months ago
- Extracting AsyncRAT configuration using CyberChef☆14May 4, 2022Updated 4 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- A vibe-coded port of wiretap☆35Apr 25, 2026Updated 2 months ago
- ☆14Mar 9, 2023Updated 3 years ago
- Async PICO Hub is a work-in-progress framework to extend Cobalt Strike with custom event monitoring and in-process Asynchronous BOFs☆24Jun 4, 2026Updated last month
- mod to myaut2exe decompiler☆20Jul 28, 2017Updated 8 years ago
- Kerberos CNAME abuse PoC☆108Jan 27, 2026Updated 5 months ago
- Object file loader implemented as a post-ex DLL for asynchronous BOF execution.☆29Jun 15, 2026Updated last month
- Python script to leverage MSFT_MTProcess WMI class☆40Sep 17, 2025Updated 10 months ago
- A list of Cheatsheet compiled by CloudBreach Team☆50Jun 18, 2026Updated last month
- Test AMSI Provider implementation in C#☆46Dec 18, 2024Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Determine if the WebClient Service (WebDAV) is running on a remote system☆22Nov 28, 2025Updated 7 months ago
- Kaspersky Security Center: custom decoders and rules for Wazuh SIEM☆26Aug 16, 2024Updated last year
- Print the stack trace☆51Mar 8, 2026Updated 4 months ago
- bring your own clean ntdll (or other MS dlls)☆29Jul 14, 2025Updated last year
- Code and data for our paper "Onelogon: Taking over Active Directory Accounts via Netlogon" (WOOT’26).☆112Jun 22, 2026Updated 3 weeks ago
- A free data collection and YARA scanning tool for cybersecurity incident investigation, compromise assessment and threat hunting☆23Nov 12, 2024Updated last year
- A Kubernetes Forensic Collection Framework for Azure Kubernetes Service☆43Feb 9, 2026Updated 5 months ago
- AdaptixC2 default beacon agent extended to support Crystal Palace loaders.☆63May 4, 2026Updated 2 months ago
- Used to get NTLMv2 Hashes from SMB☆27Oct 24, 2024Updated last year
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- AdaptixC2 Templates☆32Apr 10, 2026Updated 3 months ago
- Mythic C2 CheatSheet for OSEP☆69Jun 17, 2026Updated last month
- Generate an Alphabetical Polymorphic Shellcode☆145Aug 19, 2025Updated 11 months ago
- Token impersonation in PowerShell to execute under the context of another user.☆25Oct 14, 2025Updated 9 months ago
- Utility tool to ingest CSV files into Kusto☆21Dec 17, 2025Updated 7 months ago
- Wonka is a sweet Windows tool that extracts Kerberos tickets from the Local Security Authority (LSA) cache. Like finding a ticket, but fo…☆173Jun 19, 2026Updated last month
- Dump LSASS via physical memory read primitives in vulnerable kernel drivers☆35Feb 25, 2026Updated 4 months ago