davehull Goto Github PK

ace

Automated, Collection, and Enrichment Platform

add-header

Utility script for adding a header to a data file

analyzemft

at-ps

Adversary Tactics - PowerShell Training

autorunalyzer

A Python script for performing analysis of the output from Microsoft's Sysinternals Autoruns.

awesome-quant

A curated list of insanely awesome libraries, packages and resources for Quants (Quantitative Finance)

awesome-threat-intelligence

A curated list of Awesome Threat Intelligence resources

body-meta-dist

A Python script that parses the contents of an fls bodyfile (see The Sleuth Kit) and outputs the distribution of the metadata element passed as an argument.

body-outliers

A Python script for finding outliers in fls bodyfiles (see The Sleuth Kit) based on given metadata elements like metadata address, atime, ctime, crtime and mtime.

body-ugid-dist

A Python script that parses the contents of an fls bodyfile (see The Sleuth Kit) and outputs the distribution of u/gids per directory. This has been useful for finding malicious code that an attacker has placed on a Linux host while neglecting to change u/gids to match "normal" values for the given directory.

cimsweep

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.

datascience

Curated list of Python resources for data science.

davehull.github.io

demos

Various demos

dnspy

.NET debugger and assembly editor

empire

Empire is a PowerShell and Python post-exploitation agent.

enumerationvisualized

exif2georss

Takes GPS Exif metadata from image files (or whatever) and creates a GeoRSS file suitable for import into Bing Maps. See http://trustedsignal.blogspot.com/2012/02/plotting-photo-location-data-with-bing.html.

get-fields

Returns the field names from a separated values file, assuming the first line contains a header.

get-stakrank

A Powershell script for frequency analysis of separated values data files.

get-webfile

Powershell script based on Boe Prox's Get-WebPage.ps1, but this one pulls down a specific file

ghidra

grr

handson-ml2

A series of Jupyter notebooks that walk you through the fundamentals of Machine Learning and Deep Learning in Python using Scikit-Learn, Keras and TensorFlow 2.

ioc_writer

joystick

Joystick is a tool that gives you the ability to transform the ATT&CK Evaluations data into concise views that brings forward the nuances in the results.

kansa

A Powershell incident response framework

krabsetw

KrabsETW provides a modern C++ wrapper around the low-level ETW trace consumption functions.

loki

Loki - Simple IOC and Incident Response Scanner

lpeworkshop

Windows / Linux Local Privilege Escalation Workshop