Alternatives and similar repositories for CobaltStrikeForensic

Users that are interested in CobaltStrikeForensic are comparing it to the libraries listed below

• sysopfb / malware_decoders
  Static based decoders for malware samples
  ☆94Updated 5 years ago
• fox-it / cobaltstrike-extraneous-space
  Historical list of {Cobalt Strike,NanoHTTPD} servers
  ☆121Updated 6 years ago
• vysecurity / CobaltSplunk
  Splunk Dashboard for CobaltStrike logs
  ☆89Updated 4 years ago
• SpiderMate / Red-Teaming
  Ex-pv8's
  ☆64Updated 6 years ago
• CyberMonitor / Invoke-Adversary
  Simulating Adversary Operations
  ☆96Updated 7 years ago
• v1ado / HIPS_LIPS
  Community maintained list of most popular HIPS service and process names on a Windows Platform.
  ☆43Updated 3 years ago
• kirk-sayre-work / VBASeismograph
  A tool for detecting VBA stomping.
  ☆100Updated 3 years ago
• nccgroup / pybeacon
  A collection of scripts for dealing with Cobalt Strike beacons in Python
  ☆168Updated 4 years ago
• GoSecure / DLLPasswordFilterImplant
  DLL Password Filter Implant with Exfiltration Capabilities
  ☆138Updated 5 years ago
• praetorian-inc / vulcan
  a tool to make it easy and fast to test various forms of injection
  ☆173Updated 6 years ago
• FixTheExchange / Invoke-ExchangeWebShellHunter
  PowerShell script for hunting webshells on Microsoft Exchange Servers.
  ☆56Updated 8 years ago
• xorrior / raven
  CobaltStrike External C2 for Websockets
  ☆197Updated 6 years ago
• rvrsh3ll / Word-Doc-Video-Embed-EXE-POC
  ☆94Updated 6 years ago
• Und3rf10w / external_c2_framework
  Python api for usage with cobalt strike's External C2 specification
  ☆241Updated 2 years ago
• ashemery / CuckooVM
  Cuckoo running in a nested hypervisor
  ☆128Updated 5 years ago
• RhinoSecurityLabs / Aggressor-Scripts
  Aggregation of Cobalt Strike's aggressor scripts.
  ☆141Updated 7 years ago
• cyberark / ketshash
  A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.
  ☆172Updated 8 months ago
• xenoscr / atomiccaldera
  A MITRE Caldera plugin written in Python 3 used to convert Red Canary Atomic Red Team Tests to MITRE Caldera Stockpile YAML ability files…
  ☆73Updated 4 years ago
• jymcheong / AutoTTP
  Automated Tactics Techniques & Procedures
  ☆258Updated 2 years ago
• sisoc-tokyo / Real-timeDetectionAD_ver2
  ☆82Updated 4 years ago
• homjxi0e / PowerAvails
  PowerAvails is a unit of collection of Powershell modules that help you get done many things
  ☆118Updated 6 years ago
• shellster / DCSYNCMonitor
  Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events.
  ☆141Updated 7 years ago
• 0x09AL / Browser-C2
  Post Exploitation agent which uses a browser to do C2 operations.
  ☆103Updated 7 years ago
• mdsecactivebreach / SharpPack
  An Insider Threat Toolkit
  ☆154Updated 6 years ago
• homjxi0e / LOLBAS222
  APT || Execution || Launch || APTs || ( Authors harr0ey, bohops )
  ☆110Updated 7 years ago
• decoder-it / whoami-priv-Hackinparis2019
  Slides from my talk in "Hackinparis" 2019 edition
  ☆91Updated 6 years ago
• mkorman90 / sysmon-config-bypass-finder
  Detect possible sysmon logging bypasses given a specific configuration
  ☆110Updated 6 years ago
• n0pe-sled / WMI-Persistence
  ☆83Updated 8 years ago
• nettitude / Invoke-PowerThIEf
  The PowerThIEf, an Internet Explorer Post Exploitation library
  ☆130Updated 7 months ago
• kmkz / PowerShell
  Some .ps1 scripts for pentesting
  ☆137Updated 3 weeks ago