A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts
☆188Aug 18, 2026Updated 2 months ago
Alternatives and similar repositories for Blauhaunt
Users that are interested in Blauhaunt are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ShellSweeping the evil.☆185Jul 22, 2026Updated 3 months ago
- A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID☆690Oct 26, 2026Updated last week
- A centralized and enhanced memory analysis platform☆541Sep 29, 2026Updated last month
- The purpose of this project is to publish and maintain the deployment PowerShell script that automates deployments for Active Directory C…☆276Nov 24, 2023Updated 2 years ago
- ☆11Jun 12, 2023Updated 3 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- DFIQ is a collection of investigative questions and the approaches for answering them☆318Mar 10, 2026Updated 7 months ago
- ☆212May 10, 2026Updated 5 months ago
- A repository to share publicly available Velociraptor detection content☆210Updated this week
- Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.☆3,442Updated this week
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆875Updated this week
- Documentation and scripts to properly enable Windows event logs.☆725Oct 3, 2025Updated last year
- FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is de…☆829Apr 18, 2026Updated 6 months ago
- A repository hosting example goodware evtx logs containing sample software installation and basic user interaction☆93Sep 14, 2026Updated last month
- Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts…☆1,181Updated this week
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detection…☆874Jan 20, 2022Updated 4 years ago
- The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifa…☆668Updated this week
- Awesome list of keywords and artifacts for Threat Hunting sessions☆684Aug 4, 2025Updated last year
- ☆569Mar 28, 2024Updated 2 years ago
- Project based on RegRipper, to extract add'l value/pivot points from TLN events file☆90Feb 9, 2025Updated last year
- MDE relies on some of the Audit settings to be enabled☆101Jul 15, 2022Updated 4 years ago
- A powerful Windows command-line tool for analyzing and searching ETW (Event Tracing for Windows) provider permissions from the Windows re…☆93Jul 29, 2025Updated last year
- ☆86Feb 4, 2026Updated 9 months ago
- orc2timeline extracts and analyzes artifacts contained in archives generated with DFIR-ORC.exe to create a timeline from them☆34Jun 27, 2025Updated last year
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Provides an advanced input.conf file for Windows and 3rd party related software with more than 70 different event log mapped to the MITRE…☆101Apr 7, 2026Updated 7 months ago
- UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It …☆1,509Oct 26, 2026Updated last week
- Bulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard☆20Updated this week
- A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data int…☆2,581Updated this week
- Live Feed of C2 servers, tools, and botnets☆783Apr 13, 2026Updated 6 months ago
- This project aims to compare and evaluate the telemetry of various EDR products.☆2,002Oct 30, 2026Updated last week
- NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into W…☆154May 7, 2024Updated 2 years ago
- MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR☆743Aug 31, 2026Updated 2 months ago
- Rapidly Search and Hunt through Windows Forensic Artefacts☆3,709Updated this week
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）☆774Feb 3, 2023Updated 3 years ago
- Expose a lot of MDE telemetry that is not easily accessible in any searchable form☆122Aug 19, 2025Updated last year
- ☆133Feb 19, 2026Updated 8 months ago
- Uses Sharphound, Bloodhound and Neo4j to produce an actionable list of attack paths for targeted remediation.☆489Jul 9, 2024Updated 2 years ago
- This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.☆93Aug 30, 2024Updated 2 years ago
- Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows…☆2,152Dec 11, 2024Updated last year
- ☆2,443Oct 14, 2023Updated 3 years ago