op7ic / amphuntLinks
This repository contains advanced threat hunting scripts for Cisco Secure Endpoint API. The scripts leverage the AMP API to hunt for threats, analyze endpoint behavior, and detect potential compromises across the environment using API version 0 and 1.
☆14Updated 7 months ago
Alternatives and similar repositories for amphunt
Users that are interested in amphunt are comparing it to the libraries listed below
Sorting:
- PowerShell Memory Pulling script☆19Updated 10 years ago
- ☆13Updated 6 years ago
- PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.☆40Updated 3 years ago
- This repository contains all the config files and scripts used for our Open Source Endpoint monitoring project.☆35Updated 6 years ago
- THOR MITRE ATT&CK Framework Coverage☆25Updated 5 years ago
- Incident Response Network Tools☆24Updated 4 years ago
- Threat intelligence and threat detection indicators (IOC, IOA)☆52Updated 5 years ago
- Automatic Sender Policy Framework Reconnaissance☆19Updated 7 years ago
- Triage automation for suspect URLs☆13Updated 6 years ago
- Snapshot, patch, health-check, and potentially roll-back Windows VMs☆34Updated 7 years ago
- Create alerts in The Hive from your Graylog alerts, to be turned into Hive cases.☆45Updated 5 years ago
- Site for IWS book content☆17Updated 7 years ago
- Splunk App to assist Sysmon Threat Hunting☆38Updated 8 years ago
- Indicator of Compromise Scanner for CVE-2019-19781☆94Updated 5 years ago
- Defence Against the Dark Arts☆34Updated 6 years ago
- Splunk Add-on for PowerShell provides field extraction for PowerShell event logs.☆17Updated 4 years ago
- Indices for courses in SANS' Network Security Operations curriculum☆17Updated 9 years ago
- ☆30Updated 7 years ago
- A collection of hunting and blue team scripts. Mostly others, some my own.☆38Updated 3 years ago
- ☆17Updated 5 years ago
- Information about most important hunts which can be performed by Threat hunters while searching for any adversary/threats inside the orga…☆15Updated 6 years ago
- ☆39Updated 5 years ago
- Docker Container to deploy Mitre Caldera Automated Adversary Emulation System☆26Updated 5 years ago
- Wrap any binary into a cached webserver☆57Updated 3 years ago
- OSSEM Modular☆27Updated 5 years ago
- pollen - A command-line tool for interacting with TheHive☆36Updated 6 years ago
- A script to assist in processing forensic RAM captures for malware triage☆26Updated 4 years ago
- ☆33Updated last year
- A simple many-rules to many-files YARA scanner for incident response or malware zoos.☆27Updated 7 years ago
- ☆47Updated last month