honeyswarm / honeyswarm

Related projects: ⓘ

• ssnkhan / adversarial-threat-modelling
  Supporting material for my presentation "Adversarial Threat Modelling — A Practical Approach to Purple Teaming in the Enterprise"
  ☆50Updated 2 years ago
• timfrazier1 / AdversarySimulation
  Compilation of resources to help with Adversary Simulation automation harness
  ☆99Updated 4 years ago
• andreafortuna / malhunt
  Hunt malware with Volatility
  ☆46Updated 4 months ago
• ValcanK / HomeLab
  ☆19Updated 3 years ago
• iThreatopedia / iThreatopedia.github.io
  A happy place for detection engineers, purple teamers and threat hunters focusing on macOS.
  ☆20Updated 2 years ago
• SecurityRiskAdvisors / dredd
  Automated detection rule analysis utility
  ☆29Updated last year
• 3CORESec / Automata
  Automatic detection engineering technical state compliance
  ☆49Updated 2 months ago
• clong / detect-responder
  ☆76Updated 6 years ago
• nasbench / C2-Matrix-Indicators
  This repository aims to collect and document indicators from the different C2's listed in the C2-Matrix
  ☆72Updated 2 years ago
• jwillyamz / ezEmu
  See adversary, do adversary: Simple execution of commands for defensive tuning/research (now with more ELF on the shelf)
  ☆102Updated last year
• fozavci / ta505plus
  TA505+ Adversary Simulation
  ☆64Updated 3 years ago
• emulation-plans / emulation-plans
  A list of Mitre Caldera compatible emulation-plans
  ☆14Updated 3 years ago
• OllieJC / tbat
  Threat Box Assessment Tool
  ☆19Updated 3 years ago
• NVISOsecurity / nviso-cti
  ☆40Updated 5 months ago
• moullos / Mitigate
  Machine Interrogation To Identify Gaps & Techniques for Execution
  ☆32Updated 2 years ago
• ps-interactive / labs_modern_malware_c2
  labs_modern_malware_c2 Originally supporting Defcon workshop, will morph into Attack Defend for C2.
  ☆18Updated 2 years ago
• correlatedsecurity / SPEED-SIEM-Use-Case-Framework
  Repository for SPEED SIEM Use Case Framework
  ☆52Updated 4 years ago
• tsale / BlueSploit
  BlueSploit is a DFIR framework with the main purpose being to quickly capture artifacts for later review.
  ☆32Updated 4 years ago
• krakow2600 / atomic-threat-coverage
  The project was moved here https://github.com/atomic-threat-coverage/atomic-threat-coverage
  ☆23Updated 5 years ago
• svch0stz / TheThreatHuntLibrary
  Library of threat hunts to get any user started!
  ☆40Updated 4 years ago
• ReconInfoSec / rhq
  Recon Hunt Queries
  ☆76Updated 3 years ago
• lawiet47 / autoresponder
  Carbon Black Response IR tool
  ☆53Updated 3 years ago
• jshlbrd / threat-hunting-pocket-guide
  pocket guide for core threat hunting concepts
  ☆23Updated 4 years ago
• mkorman90 / sysmon-config-bypass-finder
  Detect possible sysmon logging bypasses given a specific configuration
  ☆107Updated 5 years ago
• mattnotmax / DFIR-notes
  Random notes collected on the intertubes relating to DFIR
  ☆32Updated last year
• OTRF / API-To-Event
  A repo to document API functions mapped to security events across diverse platforms
  ☆74Updated 4 years ago
• Maboalenen / DFIR
  Incident response teams usually working on the offline data, collecting the evidence, then analyze the data
  ☆44Updated 2 years ago
• vadim-hunter / Threat-Hunters-KB
  Threat Hunter's Knowledge Base
  ☆21Updated 2 years ago
• SecurityRiskAdvisors / ATTiRe
  Attack Tool Timing and Reporting - Structured Attack Logging Format
  ☆21Updated last year
• swimlane / PSAttck
  PSAttck is a light-weight framework for the MITRE ATT&CK Framework.
  ☆38Updated 2 years ago