Alternatives and similar repositories for RetrievIR:

Users that are interested in RetrievIR are comparing it to the libraries listed below

• MHaggis / PowerShell-Hunter
  PowerShell tools to help defenders hunt smarter, hunt harder.
  ☆206Updated 2 weeks ago
• SecurityAura / DE-TH-Aura
  Repository where I hold random detection and threat hunting queries that I come up with based on different sources of information (or eve…
  ☆85Updated this week
• Bert-JanP / Sentinel-Automation
  Sentinel Logic Apps/Playbooks to automate enrichment, incident analysis and more.
  ☆79Updated last week
• techspence / ADeleginator
  A companion tool that uses ADeleg to find insecure trustee and resource delegations in Active Directory
  ☆163Updated 4 months ago
• LearningKijo / ResearchDev
  ResearchDev - XDR & SIEM Detection
  ☆63Updated last month
• reprise99 / 4688-sysmon
  ☆58Updated last year
• mvelazc0 / msInvader
  M365/Azure adversary simulation tool that generates realistic attack telemetry to help blue teams improve their detection and response ca…
  ☆272Updated 3 weeks ago
• SpecterOps / TierZeroTable
  Table of AD and Azure assets and whether they belong to Tier Zero
  ☆208Updated this week
• tsale / EDR-Telemetry-Website
  ☆73Updated 3 weeks ago
• AirbusProtect / AD-Canaries
  The purpose of this project is to publish and maintain the deployment PowerShell script that automates deployments for Active Directory C…
  ☆246Updated last year
• olafhartong / DefenderHarvester
  Expose a lot of MDE telemetry that is not easily accessible in any searchable form
  ☆103Updated last month
• Cyb3r-Monk / ACCD
  Active C&C Detector
  ☆152Updated last year
• 0xAnalyst / DefenderATPQueries
  Hunting Queries for Defender ATP
  ☆79Updated 2 months ago
• JumpsecLabs / TokenSmith
  TokenSmith generates Entra ID access & refresh tokens on offensive engagements. It is suitable for both covert adversary simulations and …
  ☆233Updated last week
• zh54321 / PoCEntraDeviceComplianceBypass
  Simple pure PowerShell POC to bypass Entra / Intune Compliance Conditional Access Policy
  ☆125Updated 3 weeks ago
• CrowdStrike / VirtualGHOST
  VirtualGHOST Detection Tool
  ☆89Updated 8 months ago
• secureworks / pytune
  ☆186Updated last month
• BushidoUK / Ransomware-Vulnerability-Matrix
  A collection of CVEs weaponized by ransomware operators
  ☆103Updated 3 weeks ago
• csandker / Azure-AccessPermissions
  ☆106Updated last year
• LuemmelSec / Client-Checker
  ☆173Updated last month
• Mayyhem / Maestro
  Abusing Intune for Lateral Movement over C2
  ☆322Updated 2 weeks ago
• xg5-simon / MS-Graph-BlueTeam
  MS Graph Commands and Tools for Blue Teamers
  ☆49Updated last year
• zh54321 / EntraTokenAid
  A pure PowerShell solution for Entra OAuth authentication, enabling easy retrieval of access and refresh tokens
  ☆57Updated 2 weeks ago
• LuemmelSec / Custom-BloodHound-Queries
  ☆175Updated last month
• Qazeer / FarsightAD
  PowerShell script that aim to help uncovering (eventual) persistence mechanisms deployed by a threat actor following an Active Directory …
  ☆93Updated last year
• PShlyundin / GPOHunter
  A security assessment tool for analyzing Active Directory Group Policy Objects (GPOs) to identify misconfigurations and vulnerabilities
  ☆191Updated 3 weeks ago
• Sam0x90 / CTI
  Repo containing various intel-based resources such as threat research, adversary emulation/simulation plan and so on
  ☆81Updated 9 months ago
• securityjoes / ForensicMiner
  A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
  ☆150Updated 8 months ago
• CTI-Driven / LOLBins
  The LOLBins CTI-Driven (Living-Off-the-Land Binaries Cyber Threat Intelligence Driven) is a project that aims to help cyber defenders und…
  ☆116Updated 9 months ago
• LOLAD-Project / LOLAD-Project.github.io
  https://lolad-project.github.io/
  ☆71Updated 3 weeks ago