PowerShell script utilized to pull several forensic artifacts from a live Win7 and WinXP system without WINRM.

Purple Team Exercise Framework

A curated list of awesome console services (reachable via HTTP, HTTPS and other network protocols)

Please no pull requests for this repository. Thanks!

tinyproxy - a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems

ip to location database by ASN, GeoFeed, Whois, iptoasn.com, db-ip lite, GeoLite2

Jira Secret Hunter - Helps you find credentials and sensitive contents in Jira tickets

A cross-platform baselining, threat hunting, and attack surface analysis tool for security teams.

Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams.

A repository of curated datasets from various attacks

Open Source Identity and Access Management For Modern Applications and Services

Simulating Adversary Operations

Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team p…

Flipper Zero firmware source code

SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader

Attack and defend active directory using modern post exploitation adversary tradecraft activity

Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)

Source code for the book "Black Hat Python" by Justin Seitz. The code has been fully converted to Python 3, reformatted to comply with PEP8 standards and refactored to eliminate dependency issues i…

Contact: CRT@crowdstrike.com

SunBurst DGA Decode Script

Azure Red Team tool for graphing Azure and Azure Active Directory objects

🔪 Leak git repositories from misconfigured websites

PoC for Zerologon - all research credits go to Tom Tervoort of Secura

A repository of sysmon configuration modules

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world.…

SkyArk helps to discover, assess and secure the most privileged entities in Azure and AWS

Incident Response Methodologies