Alternatives and similar repositories for defending-off-the-land:

Users that are interested in defending-off-the-land are comparing it to the libraries listed below

• 100DaysofYARA / 2025
  Rules shared by the community from 100 Days of YARA 2025
  ☆31Updated 2 months ago
• magicsword-io / LOLBASline
  Baseline a Windows System against LOLBAS
  ☆26Updated 11 months ago
• brayden031 / varalyze
  Cyber threat intelligence tool suite.
  ☆20Updated this week
• krdmnbrk / atomicgen.io
  A simple tool designed to create Atomic Red Team tests with ease.
  ☆39Updated 3 weeks ago
• cbecks2 / edr-artifacts
  This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.
  ☆78Updated 7 months ago
• LOLESXi-Project / LOLESXi
  LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. T…
  ☆122Updated 2 months ago
• Neo23x0 / god-mode-rules
  God Mode Detection Rules
  ☆134Updated 7 months ago
• 0xAnalyst / Project-Lost
  Living Off Security Tools
  ☆45Updated 5 months ago
• CTI-Driven / LOLBins
  The LOLBins CTI-Driven (Living-Off-the-Land Binaries Cyber Threat Intelligence Driven) is a project that aims to help cyber defenders und…
  ☆119Updated last year
• securityjoes / Crowdstrike-Deploy
  The ultimate repository for remotely deploying Crowdstrike sensors quickly and discreetly on any other EDR platform.
  ☆22Updated this week
• krdmnbrk / AttackRuleMap
  Mapping of open-source detection rules and atomic tests.
  ☆159Updated 2 months ago
• tsale / EDR-Telemetry-Website
  ☆74Updated last week
• LOTTunnels / LOTTunnels.github.io
  ☆91Updated this week
• AlbinoGazelle / esxi-testing-toolkit
  🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections.
  ☆72Updated this week
• C0axx / CanaryHunter
  Canary Hunter aims to be a quick PowerShell script to check for Common Canaries in various formats generated for free on canarytokens.org
  ☆119Updated 2 years ago
• Semperis / SilverSamlForger
  Silver SAML forgery tool
  ☆49Updated last year
• Cyb3r-Monk / ACCD
  Active C&C Detector
  ☆153Updated last year
• delivr-to / detections
  A home for detection content developed by the delivr.to team
  ☆68Updated 2 months ago
• sans-blue-team / DNS-Exfiltrate
  ☆24Updated 2 years ago
• RITRedteam / StreetCred
  Tool created for Red Team to test default credentials on SSH and WinRM and then execute scripts with those credentials before the passwor…
  ☆38Updated last year
• Retrospected / PurpleKeep
  Providing Azure pipelines to create an infrastructure and run Atomic tests.
  ☆51Updated last year
• Sam0x90 / CTI
  Repo containing various intel-based resources such as threat research, adversary emulation/simulation plan and so on
  ☆81Updated 11 months ago
• Neo23x0 / Talks
  Slides of my public talks
  ☆54Updated last year
• redcanaryco / ansible-atomic-red-team
  This project is an Ansible Role to execute Atomic Red Team tests against multiple machines by wrapping Invoke-AtomicRedTeam
  ☆27Updated 9 months ago
• eric-conrad / c2-talk
  ☆38Updated last year
• mnrkbys / fjta
  FJTA (Forensic Journal Timeline Analyzer) is a tool that analyzes Linux filesystem (EXT4, XFS) journals (not systemd-journald), generates…
  ☆62Updated this week
• jischell-msft / RemoteManagementMonitoringTools
  Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations
  ☆84Updated 8 months ago
• Sam0x90 / CB-Threat-Hunting
  CarbonBlack EDR detection rules and response actions
  ☆71Updated 6 months ago
• MazX0p / CobaltSentry
  ☆23Updated last month
• cgosec / Blauhaunt
  A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you com…
  ☆167Updated last month