Invictus Incident Response
Invictus Incident Response specializes in delivering cyber incident support. We also build open-source tools, thank you for checking us out!
Invictus Incident Response
Pinned Repositories
ALFA
ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework
aws-cheatsheet
A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.
aws_dataset
A dataset with CloudTrail events from an attack simulation using Stratus.
Blue-team-app-Office-365-and-Azure
cobaltstrike
Collection of resources related to Cobalt Strike investigations
Invictus-AWS
A tool for AWS incident response, that allows for enumeration, acquisition and analysis of data from AWS environments for the purpose of incident response.
Invictus-training
Repository with supporting materials for Invictus Academy/Training
Microsoft-Extractor-Suite
A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
o365_dataset
A dataset containing Office 365 Unified Audit Logs for security research and detection
Sigma-AWS
This repository contains the research and components of our research into using Sigma for AWS Incident Response.
Invictus Incident Response's Repositories
invictus-ir/Microsoft-Extractor-Suite
A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
invictus-ir/Invictus-AWS
A tool for AWS incident response, that allows for enumeration, acquisition and analysis of data from AWS environments for the purpose of incident response.
invictus-ir/ALFA
ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework
invictus-ir/Blue-team-app-Office-365-and-Azure
invictus-ir/aws-cheatsheet
A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.
invictus-ir/o365_dataset
A dataset containing Office 365 Unified Audit Logs for security research and detection
invictus-ir/Invictus-training
Repository with supporting materials for Invictus Academy/Training
invictus-ir/Sigma-AWS
This repository contains the research and components of our research into using Sigma for AWS Incident Response.
invictus-ir/aws_dataset
A dataset with CloudTrail events from an attack simulation using Stratus.
invictus-ir/cobaltstrike
Collection of resources related to Cobalt Strike investigations
invictus-ir/macOS
Repository for macOS related security research
invictus-ir/entra-apps
List of Microsoft Apps in Entra ID
invictus-ir/gws_dataset
Google Workspace Audit logs containing several attacks
invictus-ir/kql_queries
KQL queries for Incident Response
invictus-ir/talks
An overview of our talks at security conferences
invictus-ir/Email-Forwarding-Rules
A mind map of email forwarding rule evidence in Microsoft 365
invictus-ir/KQL-threat-hunting-queries
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
invictus-ir/cyber-security-hub.github.io
Cyber Security Trainings
invictus-ir/Office-365-Extractor
The Office 365 Extractor is a tool that allows for complete and reliable extraction of the Unified Audit Log (UAL)