rainysexy Goto Github PK

aggressorscripts

Aggressor scripts for use with Cobalt Strike 3.0+

apt-hunter

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

arthir

ATT&CK Remote Threat Hunting Incident Response

auditd

Best Practice Auditd Configuration

cobalt-arsenal

My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+

demos

Repo Filled With Follow Along Guides

detectionlabelk

DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.

elastic_stack

elasticsearch

Free and Open, Distributed, RESTful Search Engine

elk-course-samples

Sample data for the ELK course

event-forwarding-guidance

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber

gpo-template-import-apt06202001

Applied Purple Teaming - (ITOCI4hr) - Infrastructure, Threat Optics, and Continuous Improvement - June 6, 2020

helk

The Hunting ELK

install-splunk-on-ubuntu-using-.deb-file

install-sysmon-powershell

Powershell Script to Install Sysmon from configuration file

logstash

Contains Logstash related content including tons of Logstash configurations

logstash-1

logstash-ecs-pipelines

a library of Logstash pipeline configuration files mapping data to the Elastic Common Schema

logstash-input-plugins

microsoft-extractor-suite

A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.

nxlog-autoconfig

osquery-attck

Mapping the MITRE ATT&CK Matrix with Osquery

osquery-configuration

A repository for using osquery for incident detection and response

osquery-pack-query

SQL powered operating system instrumentation, monitoring, and analytics.

osquery-packs-cybersift

Osquery Packs we use for customer security hardening

ppelasticsearchelasticstackidep

sysmon-dfir

Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.

sysmon-modular

A repository of sysmon configuration modules

sysmonsimulator

Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams.

ubuntu-linux---disable-thp-and-increase-ulimits