Alternatives and similar repositories for CanaryHunter:

Users that are interested in CanaryHunter are comparing it to the libraries listed below

• nyxgeek / track_the_planet
  DEFCON 31 slide deck and video link
  ☆58Updated 7 months ago
• Sam0x90 / CTI
  Repo containing various intel-based resources such as threat research, adversary emulation/simulation plan and so on
  ☆81Updated 9 months ago
• sans-blue-team / DNS-Exfiltrate
  ☆24Updated 2 years ago
• BC-SECURITY / Long-Live-The-Empire
  A comprehensive workshop aimed to equip participants with an in-depth understanding of modern Command and Control (C2) concepts, focusing…
  ☆98Updated last year
• doredry / TokenFinder
  Tool to extract powerful tokens from Office desktop apps memory
  ☆68Updated 10 months ago
• tsale / EDR-Telemetry-Website
  ☆73Updated 3 weeks ago
• NetSPI / PowerHunt
  PowerHunt is a modular threat hunting framework written in PowerShell that leverages PowerShell Remoting for data collection on scale.
  ☆64Updated last month
• LOLAD-Project / LOLAD-Project.github.io
  https://lolad-project.github.io/
  ☆71Updated 3 weeks ago
• Cyb3r-Monk / ACCD
  Active C&C Detector
  ☆152Updated last year
• LuemmelSec / Custom-BloodHound-Queries
  ☆175Updated last month
• biffalo / easy-wins-endpoint-defense
  Collection of scripts/resources/ideas for attack surface reduction and additional logging to enable better threat hunting on Windows endp…
  ☆38Updated 9 months ago
• SikretaLabs / BlueMap
  A Azure Exploitation Toolkit for Red Team & Pentesters
  ☆167Updated last year
• elementalsouls / DumpLSASS
  ☆34Updated 11 months ago
• secureworks / PhishInSuits
  ☆101Updated 3 years ago
• infosecn1nja / VeilTransfer
  VeilTransfer is a data exfiltration utility designed to test and enhance the detection capabilities. This tool simulates real-world data …
  ☆105Updated 5 months ago
• joswr1ght / basicblobfinder
  Identify Azure blobs using a wordlist of account name and container name strings
  ☆32Updated 4 years ago
• QueenSquishy / plague
  Default Detections for EDR
  ☆96Updated 11 months ago
• montysecurity / InfraHunter
  Actively hunt for attacker infrastructure by filtering Shodan results with URLScan data.
  ☆59Updated 6 months ago
• Qazeer / FarsightAD
  PowerShell script that aim to help uncovering (eventual) persistence mechanisms deployed by a threat actor following an Active Directory …
  ☆93Updated last year
• AlbinoGazelle / esxi-testing-toolkit
  🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections.
  ☆60Updated 2 weeks ago
• mlcsec / Graphpython
  Modular cross-platform Microsoft Graph API (Entra, o365, and Intune) enumeration and exploitation toolkit
  ☆140Updated last month
• SafeBreach-Labs / DoubleDrive
  A fully-undetectable ransomware that utilizes OneDrive & Google Drive to encrypt target local files
  ☆123Updated 8 months ago
• DefensiveOrigins / DO-LAB
  ☆45Updated 3 weeks ago
• dahvidschloss / CRASH
  Completely Risky Active-Directory Simulation Hub
  ☆99Updated last year
• TH3xACE / EDR-Test
  Automating EDR Testing with reference to MITRE ATTACK via Cobalt Strike [Purple Team].
  ☆147Updated last year
• secureworks / pytune
  ☆186Updated last month
• lkarlslund / deploy-goad
  Script to install prerequisites for deploying GOAD on Ubuntu Linux 22.04
  ☆109Updated 7 months ago
• tothi / smbmap
  SMBMap is a handy SMB enumeration tool - here with Kerberos support
  ☆73Updated 3 years ago
• SySS-Research / azurenum
  Enumerate Microsoft Entra ID (Azure AD) fast
  ☆89Updated 3 weeks ago
• BushidoUK / Ransomware-Vulnerability-Matrix
  A collection of CVEs weaponized by ransomware operators
  ☆103Updated 3 weeks ago