ion-storm / sysmon-edr
Sysmon EDR POC Build within Powershell to prove ability.
☆218Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for sysmon-edr
- Blueteam operational triage registry hunting/forensic tool.☆142Updated last year
- Public Repo for Atomic Test Harness☆252Updated 4 months ago
- evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.☆147Updated 2 years ago
- Anything Sysmon related from the MSTIC R&D team☆146Updated 5 months ago
- A PowerShell module to deploy active directory decoy objects.☆223Updated 5 years ago
- Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.☆194Updated 2 years ago
- A collection of tools to interact with Microsoft Security Response Center API☆95Updated 10 months ago
- A collection of Powershell scripts that will help automate the build process for a Marvel domain.☆144Updated 8 months ago
- ☆130Updated 9 months ago
- Signature engine for all your logs☆161Updated last year
- Misc Threat Hunting Resources☆372Updated last year
- ☆482Updated 2 months ago
- MAL-CL (Malicious Command-Line)☆308Updated last year
- ☆141Updated 5 months ago
- ☆222Updated 6 months ago
- The Github project for The Defender's Guide by Luke Paine and Jonathan Johnson☆145Updated last year
- A Cobalt Strike Scanner that retrieves detected Team Server beacons into a JSON object☆164Updated 2 years ago
- Detect and respond to Cobalt Strike beacons using ETW.☆481Updated 2 years ago
- Pushes Sysmon Configs☆89Updated 3 years ago
- #ThreatHunting #DFIR #Malware #Detection Mind Maps☆282Updated 3 years ago
- Active Directory Purple Team Playbook☆104Updated last year
- Detection Ideas & Rules repository.☆178Updated 3 years ago
- Powershell Event Tracing Toolbox☆72Updated 2 years ago
- A python script developed to process Windows memory images based on triage type.☆258Updated 11 months ago
- Tool for assessing on-premises Microsoft servers authentication such as ADFS, Skype, Exchange, and RDWeb☆144Updated 3 years ago
- Cobalt Strike Beacon configuration extractor and parser.☆145Updated 3 years ago
- ☆251Updated 6 months ago
- ☆187Updated 3 weeks ago
- Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-Cradle…☆289Updated 3 years ago