falconforceteam Goto Github PK

Name: FalconForce

Type: Organization

Twitter: FalconForceTeam

FalconForce's Projects

adexplorersnapshot.py

ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.

azure-sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

azurehoundautocollect

Some plumbing to automate the collection of AzureHound

bof2shellcode

POC tool to convert CobaltStrike BOF files to raw shellcode

This repository is used by FalconForce to release parts of the internal tools used for maintaining, validating and automatically deploying a repository of use-cases for the Sentinel and Microsoft 365 Defender products.

falconfriday

Hunting queries and detections

falconhound

FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool.

kqlanalyzer

REST server that can analyze Kusto KQL queries against the Sentinel and Microsoft 365 Defender schemas.

parrotforce

Azure playbook for automatic evidence collection

soaphound

SOAPHound is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADWS) protocol.