mabidm-tsinghua Goto Github PK

amsi-bypass

Bypass Amsi powershell of Matt Graeber modified

arkime

Arkime (formerly Moloch) is an open source, large scale, full packet capturing, indexing, and database system.

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

attack-python-client

Python Script to access ATT&CK content available in STIX via a public TAXII server

automatedlab

AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts. It supports all Windows operating systems from 2008 R2 to 2022, some Linux distributions and various products like AD, Exchange, PKI, IIS, etc.

balbuzard

Balbuzard is a package of malware analysis tools in python to extract patterns of interest from suspicious files (IP addresses, domain names, known file headers, interesting strings, etc). It can also crack malware obfuscation such as XOR, ROL, etc by bruteforcing and checking for those patterns.

blue-team-wiki

Tools, techniques, cheat sheets, and other resources to assist those defending organizations and detecting adversaries

books

All books

books2

botsv2

Splunk Boss of the SOC version 2 dataset.

brawl-public-game-001

Data from a BRAWL Automated Adversary Emulation Exercise

caldera

Automated Adversary Emulation Platform

capa

The FLARE team's open-source tool to identify capabilities in executable files.

capemon

capemon: CAPE's monitor

car

Cyber Analytics Repository

clearcut

Clearcut is a tool that uses machine learning to help you focus on the log entries that really need manual review

cortex

Cortex: a Powerful Observable Analysis and Active Response Engine

cortexdocs

Documentation of Cortex

cppcoreguidelines

The C++ Core Guidelines are a set of tried-and-true guidelines, rules, and best practices about coding in C++

crits

CRITs - Collaborative Research Into Threats

cuckoo-modified

Modified edition of cuckoo

cuckoo-modified-latest

Modified edition of cuckoo

cuckoomx

CuckooMX is a project to automate analysis of files transmitted over SMTP (using the Cuckoo sandbox)

dataseries

structured serial data library

dauad-flowgenerator

This is the python implementation of CICFlowMeter which aims to produce CSV based flow provided the network interface and PCAPs.

daud-flowlabeler

This is a script which is used to conditionally label/classify the flow generated by CICFlowmeter python implementation given the PCAP files.

daud-mlriding-with-redis

detection-rules

Rules for Elastic Security's detection engine

detectionlab

Automate the creation of a lab environment complete with security tooling and logging best practices

dnsexfiltrator

Data exfiltration over DNS request covert channel