blueteam0ps Goto Github PK

allthingstimesketch

This repository contains helper scripts and custom configs to get the best out of Google's Timesketch project.

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

azure-sentinel-notebooks

Interactive Azure Sentinel Notebooks provides security insights and actions to investigate anomalies and hunt for malicious behaviors.

block-parser

Parser for Windows PowerShell script block logs

bulk_extractor

This is the development tree. Production downloads are at:

calc_security_poc

A sample of proof of concept scripts that run Calc.exe with full source code.

chainsaw

Rapidly Search and Hunt through Windows Event Logs

cylr-1

CyLR - Live Response Collection Tool

deepbluecli

det-eng-samples

This repository contains sample log data that were collected after running adversary simulations in Microsoft 365

elasticsearch-plaso-pipelines

Elasticsearch pipelines for processing and enriching plaso data

evtx-attack-samples

hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

infosec_reference

An Information Security Reference That Doesn't Suck

invoke-atomicredteam

Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.

lolbas

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

lolbas-1

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

memoptix

A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.

microsoft-extractor-suite

A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.

plaso

Super timeline all the things

plaso_filters

Scripts to facilitate filtering with Plaso

public

Collection of scripts provided for public use

regripper3.0

RegRipper3.0

repo-template

A template for creating new repositories in the @orbitdb organization

rhq

Recon Hunt Queries

security-datasets

Re-play Security Events

sigma

Generic Signature Format for SIEM Systems

sigma-cli

The Sigma command line interface based on pySigma

signature-base

YARA signature and IOC database for my scanners and tools

supermem

A python script developed to process Windows memory images based on triage type.