secure-cake / win-mal-investigations

Related projects: ⓘ

• securityjoes / ForensicMiner
  A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
  ☆147Updated 3 months ago
• abdulshareef / DFIR-Resources
  Some important DFIR Resources
  ☆81Updated last year
• secure-cake / rapid-endpoint-investigations
  Scripts for rapid Windows endpoint "tactical triage" and investigations with Velociraptor and KAPE
  ☆96Updated 5 months ago
• dahvidschloss / CRASH
  Completely Risky Active-Directory Simulation Hub
  ☆99Updated 9 months ago
• BushidoUK / CTI-Analyst-Challenge
  An analytical challenge created to test junior analysts looking to try performing proactive and reactive cyber threat intelligence.
  ☆176Updated 2 months ago
• BankSecurity / Threat_Hunting
  Some Threat Hunting queries useful for blue teamers
  ☆120Updated 2 years ago
• randomaccess3 / Awesome-BEC
  Repository of attack and defensive information for Business Email Compromise investigations
  ☆216Updated 3 weeks ago
• mf1d3l / Splunk4DFIR
  Harness the power of Splunk for your investigations
  ☆66Updated last month
• keyboardcrunch / SentinelOne-ATTACK-Queries
  MITRE ATT&CK mapped queries for SentinelOne Deep Visiblity
  ☆85Updated 3 years ago
• Sam0x90 / CB-Threat-Hunting
  CarbonBlack EDR detection rules and response actions
  ☆70Updated last week
• strandjs / ClassLabs
  ☆52Updated 3 years ago
• mthcht / Purpleteam
  Purpleteam scripts simulation & Detection - trigger events for SOC detections
  ☆149Updated 2 weeks ago
• activecm / threat-tools
  Tools for simulating threats
  ☆170Updated 10 months ago
• mgreen27 / DetectRaptor
  A repository to share publicly available Velociraptor detection content
  ☆115Updated this week
• keydet89 / Events-Ripper
  Project based on RegRipper, to extract add'l value/pivot points from TLN events file
  ☆74Updated 3 weeks ago
• reversinglabs / reversinglabs-siem-rules
  A collection of various SIEM rules relating to malware family groups.
  ☆60Updated 3 months ago
• EZToolsManuals / EZToolsManuals
  A repo hosting the Markua content for the EZ Tools manuals hosted on Leanpub
  ☆62Updated last year
• socprime / the-prime-hunt
  A browser extension for threat hunting that provides one UI for different SIEMs/EDRs and simplifies investigation
  ☆75Updated 3 months ago
• archanchoudhury / DFIR-Tools
  This is the One Stop place where you can find almost all of your Tools of Requirements in DFIR
  ☆73Updated 2 years ago
• mbabinski / Sigma-Rules
  A repository of my own Sigma detection rules.
  ☆155Updated last week
• IppSec / PowerSiem
  ☆111Updated 5 months ago
• dwmetz / CyberPipe
  An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.
  ☆266Updated 3 weeks ago
• maddev-engenuity / AdversaryEmulation
  MAD ATT&CK Defender: ATT&CK Adversary Emulation Repository
  ☆105Updated last year
• pr0xylife / pr0xylife
  Config files for my GitHub profile.
  ☆15Updated last year
• CTI-Driven / LOLBins
  The LOLBins CTI-Driven (Living-Off-the-Land Binaries Cyber Threat Intelligence Driven) is a project that aims to help cyber defenders und…
  ☆108Updated 5 months ago
• tsale / Sigma_rules
  Sigma rules to share with the community
  ☆113Updated last month
• cyb3rmik3 / MDE-DFIR-Resources
  A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as …
  ☆348Updated this week
• MISP / misp-playbooks
  MISP Playbooks
  ☆167Updated 3 weeks ago
• iknowjason / AutomatedEmulation
  An automated Breach and Attack Simulation lab with terraform. Built for IaC stability, consistency, and speed.
  ☆152Updated 2 months ago
• mttaggart / blue-jupyter
  Jupyter Notebooks for the Blue Team
  ☆139Updated last year