huntresslabs / rogueapps
When good OAuth apps go rogue. Documents observed OAuth application tradecraft
☆53Updated last month
Alternatives and similar repositories for rogueapps:
Users that are interested in rogueapps are comparing it to the libraries listed below
- Azure Activity Log Axe is a continually developing tool that simplifies the transactional log format provided by Microsoft. The tool leve…☆26Updated 5 months ago
- Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations☆83Updated 6 months ago
- The ultimate solution for remotely deploying Crowdstrike sensors quickly and discreetly on any other EDR platform.☆22Updated 6 months ago
- Open Threat-Informed Detection Engineering☆37Updated last month
- ☆74Updated last week
- Mapping of open-source detection rules and atomic tests.☆125Updated last month
- Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research…☆35Updated this week
- Repository that contains a set of purposefully erroneous Yara rules.☆49Updated last year
- Rules shared by the community from 100 Days of YARA 2025☆29Updated 3 weeks ago
- VirtualGHOST Detection Tool☆89Updated 9 months ago
- Expose a lot of MDE telemetry that is not easily accessible in any searchable form☆103Updated 2 months ago
- Anvilogic Forge☆93Updated this week
- ☆46Updated 3 weeks ago
- Convert a variety of log formats to CSV while enriching detected IPs with Geolocation, ASN, DNS, WhoIs, Shodan InternetDB and Threat Indi…☆102Updated 4 months ago
- Repository with supporting materials for Invictus Academy/Training☆42Updated last month
- Elastic version of SOC prime watcher rules☆29Updated 4 months ago
- 🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections.☆68Updated last month
- A pySigma wrapper and langchain toolkit for automatic rule creation/translation☆74Updated this week
- ForgeArmory provides TTPs that can be used with the TTPForge (https://github.com/facebookincubator/ttpforge).☆99Updated 5 months ago
- Living Off Security Tools☆44Updated 3 months ago
- Monitor your PingCastle scans to highlight the rule diff between two scans☆110Updated 6 months ago
- Collection of scripts/resources/ideas for attack surface reduction and additional logging to enable better threat hunting on Windows endp…☆38Updated 10 months ago
- A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you com…☆167Updated this week
- Canary Hunter aims to be a quick PowerShell script to check for Common Canaries in various formats generated for free on canarytokens.org☆118Updated 2 years ago
- A collection of various SIEM rules relating to malware family groups.☆65Updated 8 months ago
- This project is an Ansible Role to execute Atomic Red Team tests against multiple machines by wrapping Invoke-AtomicRedTeam☆25Updated 7 months ago
- MDE relies on some of the Audit settings to be enabled☆97Updated 2 years ago
- Hunting Queries for Defender ATP☆80Updated 3 months ago
- ☆84Updated last week
- ☆24Updated 2 years ago