Pinned Repositories
100DaysofYARA
100 Days of YARA to be updated with rules & ideas as the year progresses
100DaysOfYARA-1
100DaysOfYara3
2024 100DaysOfYara rules and explanation. More on what I am trying to accomplish here: https://medium.com/@Shinigami42/100daysofyara-45bdce96d48f
2018
PowerShell Conference Europe 2018 Slides and Demo Scripts
2019-Security-Data-Science-Colloquium-
Slides and material from 2019 Security Data Science Colloquium hosted by Microsoft
2023
Rules Shared by the Community from 100 Days of YARA 2023
3-Phish-Page-Detection
A machine learning based phishing detection prototype
31-days-of-API-Security-Tips
This challenge is Inon Shkedy's 31 days API Security Tips.
Microsoft-Azure-AD-Conditional-Access-Validator
This script validates the most common Conditional Access policies in Microsoft 365.
Swift-Attack
Unit tests for blue teams to aid with building detections for some common macOS post exploitation methods.
Blue-infosec's Repositories
Blue-infosec/arkime
Arkime is an open source, large scale, full packet capturing, indexing, and database system.
Blue-infosec/armory
Anvilogic Forge
Blue-infosec/attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.
Blue-infosec/autoaudit
Welcome to Autoaudit, a log tampering detection tool.
Blue-infosec/awesome-lists
Security lists for SOC detections
Blue-infosec/bincapz
enumerate binary capabilities, including malicious behaviors
Blue-infosec/coderex
A tool that automates regex generation for the x86 and x86-64 instruction sets
Blue-infosec/DefenderYara
Extracted Yara rules from Windows Defender mpavbase and mpasbase
Blue-infosec/DefenderYara1
Extracted Yara rules from Windows Defender mpavbase and mpasbase
Blue-infosec/ELFieScanner
A C++ tool for process memory scanning & suspicious telemetry generation that attempts to detect a number of malicious techniques used by threat actors & those which have been incorporated into open-source user-mode rootkits.
Blue-infosec/go-epss
A Golang library for interacting with the EPSS (Exploit Prediction Scoring System).
Blue-infosec/Harden-Windows-Security
Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Personal, Enterprise, Government and Military security levels | Read The Rationale https://github.com/HotCakeX/Harden-Windows-Security/blob/main/Rationale.md
Blue-infosec/HijackLibs
Project for tracking publicly disclosed DLL Hijacking opportunities.
Blue-infosec/Incident-Response-Powershell
PowerShell Digital Forensics & Incident Response Scripts.
Blue-infosec/inspektor-gadget
The eBPF tool and systems inspection framework for Kubernetes, containers and Linux hosts.
Blue-infosec/Kdrill
Python tool to check rootkits in Windows kernel
Blue-infosec/lolcerts
A repository of code signing certificates known to have been leaked or stolen, then abused by threat actors
Blue-infosec/Microsoft-Analyzer-Suite
A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID
Blue-infosec/netfetch
Kubernetes tool for scanning clusters for network policies and identifying unprotected workloads.
Blue-infosec/ntopng
Web-based Traffic and Security Network Traffic Monitoring
Blue-infosec/Ransomware-Tool-Matrix
A resource containing all the tools each ransomware gangs uses
Blue-infosec/security-profiles-operator
The Kubernetes Security Profiles Operator
Blue-infosec/sinon
Automation tool for Windows Deception Host Burn-In
Blue-infosec/SSDT
Stupid Simple Detection Testing
Blue-infosec/ThreatHunting-Keywords
Awesome list of keywords and artefacts for Threat Hunting sessions
Blue-infosec/ThreatHunting-Keywords-sigma-rules
Sigma detection rules for hunting with the threathunting-keywords project
Blue-infosec/ThreatHunting-Keywords-yara-rules
yara detection rules for hunting with the threathunting-keywords project
Blue-infosec/Tier0-User-Management
Maintain Tier 0 users. This script take care all Tier 0 users are in the correct OU or in the default user container and add the Kerberos Authentication policy to the user
Blue-infosec/tracee
Linux Runtime Security and Forensics using eBPF
Blue-infosec/uac1
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.