NybbleHub / Bluekeep-Detection-RuleLinks
Bluekeep detection rule by using Apache Flink CEP (Complex Event Processing) Library and Markov Chain.
☆9Updated 5 years ago
Alternatives and similar repositories for Bluekeep-Detection-Rule
Users that are interested in Bluekeep-Detection-Rule are comparing it to the libraries listed below
Sorting:
- This is a repository that is meant to hold detections for various process injection techniques.☆34Updated 5 years ago
- ☆41Updated 2 years ago
- ETWNetMonv3 is simple C# code for Monitoring TCP Network Connection via ETW & ETWProcessMon/2 is for Monitoring Process/Thread/Memory/Ima…☆40Updated 2 years ago
- Splunk app to compare Endpoint Detection and Response solutions based on MITRE ATT&CK evaluations (APT3, APT29, Carbanak + FIN7, Wizard S…☆19Updated 2 years ago
- Look into EDR events from network☆23Updated 3 months ago
- Invoke-Decoder – A PowerShell script to decode/deobfuscate malware samples☆19Updated 5 years ago
- Windows GUI/Execution Engine for Atomic Red Team Atomics☆35Updated 5 years ago
- ☆22Updated 2 years ago
- ☆10Updated 2 years ago
- Tool to manage user privileges☆29Updated 5 years ago
- QuasarRAT analysis tools and research report☆27Updated last year
- go-atomicredteam is a Golang application to execute tests as defined in the atomics folder of Red Canary's Atomic Red Team project (https…☆49Updated 2 years ago
- A collection of Tools and Rules for decoding Brute Ratel C4 badgers☆64Updated 3 years ago
- Detecting PowerShell Empire, Metasploit Meterpreter and Cobalt Strike agents by payload size sequence analysis and host correlation☆16Updated 6 years ago
- Links to malware-related YARA rules☆15Updated 2 years ago
- Epimitheus is a tool that uses graphical database Neo4j for Windows Events visualization.☆19Updated 3 years ago
- POC code to crash Windows Event Logger Service☆27Updated 4 years ago
- Collection of malware ioc hashes from blog posts. A Python script is provided to search through it.☆17Updated 4 years ago
- Pointer was developed for massive hunting and mapping Cobalt Strike servers exposed on the internet.☆67Updated 3 years ago
- Old home of LimaCharlie, open source EDR☆31Updated last year
- Lightweight C# windows agent for Apfell☆17Updated 5 years ago
- Miscellaneous PowerShell scripts for red team activities☆16Updated 9 months ago
- Lists of AMSI triggers (VBA, JScript / VBScript)☆33Updated 6 years ago
- Minimalist Custom .NET Core Garbage Collector☆21Updated 5 years ago
- Get or remove RunMRU values☆57Updated 5 years ago
- All necessary code in order to feed Sysmon data into Recurrent Neural Network☆17Updated 5 years ago
- A collection of useful PowerShell tools to collect, organize, and visualize Sysmon event data☆39Updated 5 years ago
- I used this to see if an EDR is running in Safe Mode☆37Updated 4 years ago
- Community maintained list of most popular HIPS service and process names on a Windows Platform.☆43Updated 3 years ago
- Smart overlay for Cobalt Strike PS function☆31Updated 6 years ago