Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...

A knowledge base of actionable Incident Response techniques

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

Rapidly Search and Hunt through Windows Forensic Artefacts

A repository of DFIR-related Mind Maps geared towards the visual learners!

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

Guacamole with docker-compose using PostgreSQL, nginx with SSL (self-signed)

Guacamole with docker-compose using PostgreSQL, nginx with SSL (self-signed)

Collection of Event ID ressources useful for Digital Forensics and Incident Response

Windows event log anomaly detection powered by ATPA technologies

The easiest, and most secure way to access and protect all of your infrastructure.

A collection of PHP backdoors. For educational or testing purposes only.

Fast and efficient osquery management

An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view.

Reconstruct process trees from event logs

Microsoft Threat Intelligence Security Tools

OSCP Study Group Workbook and Guide

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

Detect Tactics, Techniques & Combat Threats

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

Splunk code (SPL) for serious threat hunters and detection engineers.

Repository with Sample KQL Query examples for Threat Hunting

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

Splunk code (SPL) for serious threat hunters and detection engineers.

Install a full Splunk Enterprise Cluster or Universal forwarder using an ansible playbook

Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

Ansible Playbook to install the ELK Stack

SIEGMA - Transform Sigma rules into SIEM consumables

SIEM Tactics, Techiques, and Procedures