cyb3rpnk

cyb3rpnk's Stars

• SpecterOps/BloodHound-Legacy

  Six Degrees of Domain Admin

  Language:PowerShell10k3775121.7k

• elceef/dnstwist

  Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

  Language:Python5k156124776

• 0x4D31/awesome-threat-detection

  ✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

  3.9k1966669

• JPCERTCC/LogonTracer

  Investigate malicious Windows logon by visualizing and analyzing Windows event log

  Language:Python2.8k135125450

• ly4k/Certipy

  Tool for Active Directory Certificate Services enumeration and abuse

  Language:Python2.5k31164345

• Cloud-Architekt/AzureAD-Attack-Defense

  This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected.

  Language:PowerShell2.2k8014321

• NetSPI/MicroBurst

  A collection of scripts for assessing Microsoft Azure security

  Language:PowerShell2.1k5922314

• dirkjanm/ROADtools

  A collection of Azure AD/Entra tools for offensive and defensive security purposes

  Language:Python2k4661274

• cisagov/ScubaGear

  Automation to assess the state of your M365 tenant against CISA's baselines

  Language:PowerShell1.9k521k238

• lkarlslund/Adalanche

  Active Directory ACL Visualizer and Explorer - who's really Domain Admin? (Commerical versions available from NetSection)

  Language:Go1.8k2934167

• sense-of-security/ADRecon

  ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.

  Language:HTML1.7k8226286

• netero1010/EDRSilencer

  A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

  Language:C1.5k2015190

• CravateRouge/bloodyAD

  BloodyAD is an Active Directory Privilege Escalation Framework

  Language:Python1.3k1443124

• SpecterOps/BloodHound

  Six Degrees of Domain Admin

  Language:Go1.2k32168124

• lkarlslund/ldapnomnom

  Quietly and anonymously bruteforce Active Directory usernames at insane speeds from Domain Controllers by (ab)using LDAP Ping requests (cLDAP)

  Language:Go1k17179

• 0xthirteen/SharpRDP

  Remote Desktop Protocol .NET Console Application for Authenticated Command Execution

  Language:C#1k3312533

• FalconForceTeam/SOAPHound

  SOAPHound is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADWS) protocol.

  Language:C#693111070

• garrettfoster13/sccmhunter

  Language:Python67724084

• Bert-JanP/Incident-Response-Powershell

  PowerShell Digital Forensics & Incident Response Scripts.

  Language:PowerShell53211575

• nettitude/SharpWSUS

  Language:C#4438375

• vm32/Linux-Incident-Response

  practical toolkit for cybersecurity and IT professionals. It features a detailed Linux cheatsheet for incident response

  Language:Shell3836156

• MarkoH17/Spray365

  Spray365 makes spraying Microsoft accounts (Office 365 / Azure AD) easy through its customizable two-step password spraying approach. The built-in execution plan features options that attempt to bypass Azure Smart Lockout and insecure conditional access policies.

  Language:Python3458957

• CyberCX-STA/PurpleOps

  An open-source self-hosted purple team management web application.

  Language:HTML24662136

• ANSSI-FR/DFIR4vSphere

  Powershell module for VMWare vSphere forensics

  Language:PowerShell1448218

• hackerhouse-opensource/WMIProcessWatcher

  A CIA tradecraft technique to asynchronously detect when a process is created using WMI.

  Language:C++1315027

• wh0amitz/SharpRODC

  To audit the security of read-only domain controllers

  Language:C#114308

• olafhartong/DefenderHarvester

  Expose a lot of MDE telemetry that is not easily accessible in any searchable form

  Language:Go101325

• LearningKijo/ResearchDev

  ResearchDev - XDR & SIEM Detection

  Language:HTML61405

• Neo23x0/Talks

  Slides of my public talks

  48601

• Visorian/PSMDE

  Microsoft Defender for Endpoint PowerShell module

  Language:PowerShell13142