defensiveorigins Goto Github PK

add_extras

ADD Extras

apt-lab-fastopticssetup

Scripts to threat optics stack quickly / abbreviated and automated. Run after APT-Lab-Terraform

apt-lab-terraform

Purple Teaming Attack & Hunt Lab - Terraform

apt-lab-terraform-linux

apt-prereqs

Applied Purple Teaming Course Pre-Requisites

apt06202001

Applied Purple Teaming - (ITOCI4hr) - Infrastructure, Threat Optics, and Continuous Improvement - June 6, 2020

apt22things

Location for a few things necessary for APT22

aptv4_defcon28

Defcon 28 - Red Team Village - Applied Purple Teaming - Why Can't We Be Friends

atomicpurpleteam

Atomic Purple Team Framework and Lifecycle

autospfrecon

Automatic Sender Policy Framework Reconnaissance

badblood

BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.

bl-bfg

bloodhound

Six Degrees of Domain Admin

bloodhound.py

A Python based ingestor for BloodHound

bruteloops

deploy-deception

A PowerShell module to deploy active directory decoy objects.

det062021

do-lab

dolib-images

Repo for Defensive Origins images for markdown, etc.

domainbuildscripts

Build a domain with three quick PowerShell scripts!

domainpasswordspray

DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!

dte_extras

dtesrc2022

Additional resources for DTE 2022

empire

Empire is a PowerShell and Python post-exploitation agent.

hostrecon

This function runs a number of checks on a system to help provide situational awareness to a penetration tester during the reconnaissance phase. It gathers information about the local system, users, and domain information. It does not use any 'net', 'ipconfig', 'whoami', 'netstat', or other system commands to help avoid detection.

impacket

Impacket is a collection of Python classes for working with network protocols.

labpack

Various components we use in labs

mssentinelsysmonparser

A simple parser for Sysmon logs through EID28 for Microsoft Sentinel

opticsbuilder

Install Threat Optics

petitpotam

PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.