The Github project for The Defender's Guide by Luke Paine and Jonathan Johnson
☆157Jun 15, 2023Updated 3 years ago
Alternatives and similar repositories for TheDefendersGuide
Users that are interested in TheDefendersGuide are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A repository that maps commonly used attacks using MSRPC protocols to ATT&CK☆349May 30, 2023Updated 3 years ago
- ☆266May 9, 2024Updated 2 years ago
- Documentation and scripts to properly enable Windows event logs.☆725Oct 3, 2025Updated last year
- A compilation of Aggressor/Sleep scripts for operational purposes that I've made.☆11Sep 17, 2021Updated 5 years ago
- ☆273Jun 7, 2025Updated last year
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- RRR (Rapid Response Reporting) is a collection of Incident Response Report objects. They are designed to help incident responders provid…☆37Apr 6, 2022Updated 4 years ago
- Default Detections for EDR☆96Feb 20, 2024Updated 2 years ago
- Collection of Event ID ressources useful for Digital Forensics and Incident Response☆665Jun 19, 2024Updated 2 years ago
- ☆11Jun 12, 2023Updated 3 years ago
- .NET library and PowerShell module for Windows RPC filter management☆28Mar 28, 2026Updated 7 months ago
- TrustedSec Sysinternals Sysmon Community Guide☆1,447Jun 30, 2026Updated 4 months ago
- Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows…☆2,152Dec 11, 2024Updated last year
- This project aims to compare and evaluate the telemetry of various EDR products.☆2,002Oct 30, 2026Updated last week
- Protect your Domain Controllers by auditing and restricting LDAP requests☆191May 29, 2025Updated last year
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- A Cobalt Strike Scanner that retrieves detected Team Server beacons into a JSON object☆169Oct 14, 2022Updated 4 years ago
- Rules generated from our investigations.☆214Jul 8, 2026Updated 3 months ago
- Threat Simulator for Enterprise Networks☆15May 14, 2022Updated 4 years ago
- Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detection…☆874Jan 20, 2022Updated 4 years ago
- Reverse Engineering and Debugging Malware☆31Feb 27, 2023Updated 3 years ago
- Pushes Sysmon Configs☆91Jun 11, 2021Updated 5 years ago
- Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).☆831Oct 21, 2026Updated 2 weeks ago
- Detection engineering template☆15Jul 24, 2025Updated last year
- MDE relies on some of the Audit settings to be enabled☆101Jul 15, 2022Updated 4 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Abusing Azure services over C2☆382Jan 20, 2026Updated 9 months ago
- You didn't think I'd go and leave the blue team out, right?☆1,784Sep 23, 2026Updated last month
- The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifa…☆668Updated this week
- PowerShell script helping Incident Responders discover potential adversary persistence mechanisms.☆343May 1, 2025Updated last year
- Finding all things on-prem Microsoft for password spraying and enumeration.☆257May 17, 2022Updated 4 years ago
- ☆107Nov 1, 2026Updated last week
- Threat Hunting Toolkit is a Swiss Army knife for threat hunting, log processing, and security-focused data science☆156Oct 1, 2026Updated last month
- Apply a filter to the events being reported by windows event logging☆262Apr 24, 2021Updated 5 years ago
- A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.☆98May 28, 2023Updated 3 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Detection Ideas & Rules repository.☆179Sep 10, 2021Updated 5 years ago
- The idea is simply to save some quick notes that will make it easier for Splunk users to leverage KQL (Kusto), especially giving projects…☆45Nov 7, 2020Updated 6 years ago
- Placeholder for my detection repo and misc detection engineering content☆44Oct 20, 2023Updated 3 years ago
- Azure playbook for automatic evidence collection☆13Jul 3, 2023Updated 3 years ago
- Detect Tactics, Techniques & Combat Threats☆2,358Updated this week
- PowerShell PE Parser☆63Jun 28, 2024Updated 2 years ago
- A repository of sysmon configuration modules☆3,186Oct 14, 2026Updated 3 weeks ago