infosecB / LOOBins
Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.
☆461Updated 4 months ago
Alternatives and similar repositories for LOOBins:
Users that are interested in LOOBins are comparing it to the libraries listed below
- a tool to help operate in EDRs' blind spots☆728Updated 4 months ago
- IATelligence is a Python script that will extract the IAT of a PE file and request GPT to get more information about the API and the ATT&…☆360Updated 2 years ago
- WTF are these binaries doing?! A list of benign applications that mimic malicious behavior.☆164Updated 3 weeks ago
- LotL RMM☆170Updated 3 weeks ago
- Jupyter Notebooks for the Blue Team☆145Updated 3 weeks ago
- Aftermath is a free macOS IR framework☆502Updated 4 months ago
- Repository of attack and defensive information for Business Email Compromise investigations☆250Updated 2 months ago
- The purpose of this project is to publish and maintain the deployment PowerShell script that automates deployments for Active Directory C…☆250Updated last year
- An automated Breach and Attack Simulation lab with terraform. Built for IaC stability, consistency, and speed.☆188Updated 9 months ago
- Signatures and IoCs from public Volexity blog posts.☆352Updated 2 months ago
- A python script developed to process Windows memory images based on triage type.☆262Updated last year
- An open-source self-hosted purple team management web application.☆267Updated 3 weeks ago
- Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.☆201Updated 2 years ago
- Blue Team detection lab created with Terraform and Ansible in Azure.☆153Updated 5 months ago
- Purple Team Exercise Framework☆693Updated last year
- Rules generated from our investigations.☆194Updated 3 weeks ago
- An offensive data enrichment pipeline☆670Updated last week
- Offensive security and Penetration Testing TTP for Cloud based environment (AWS / Azure / GCP)☆325Updated last month
- Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA.☆247Updated 2 years ago
- BadZure orchestrates the setup of Azure AD tenants, populating them with diverse entities while also introducing common security misconfi…☆451Updated last week
- LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. T…☆123Updated 2 months ago
- Ransomware simulator written in Golang☆433Updated 2 years ago
- A Python package is used to execute Atomic Red Team tests (Atomics) across multiple operating system environments.☆138Updated 9 months ago
- Open Threat Hunting Framework☆113Updated last year
- Infrastructure Automation☆344Updated last year
- Uses Sharphound, Bloodhound and Neo4j to produce an actionable list of attack paths for targeted remediation.☆459Updated 9 months ago
- Retired TrustedSec Capabilities☆246Updated 4 months ago
- This is a collection of threat detection rules / rules engines that I have come across.☆285Updated 11 months ago
- ForgeArmory provides TTPs that can be used with the TTPForge (https://github.com/facebookincubator/ttpforge).☆107Updated 7 months ago
- LOLAPPS is a compendium of applications that can be used to carry out day-to-day exploitation.☆184Updated 2 months ago