mevry

mevry's Stars

• mandiant/gocrack

  GoCrack is a management frontend for password cracking tools written in Go

  Language:Go1.2k242

• Azure/securedworkstation

  Intune managed Secured workstation

  Language:PowerShell23053

• guyrleech/General-Scripts

  Scripts for diagnosis, troubleshooting, automation, etc.

  Language:PowerShell8617

• threathunters-io/laurel

  Transform Linux Audit logs for SIEM usage

  Language:Rust70656

• Cyb3r-Monk/Threat-Hunting-and-Detection

  Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

  Language:Jupyter Notebook62799

• rod-trent/KQLMysteries

  The collateral repository for The KQL Mysteries series

  18

• CyberCX-STA/PurpleOps

  An open-source self-hosted purple team management web application.

  Language:HTML24035

• last-byte/PersistenceSniper

  Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte

  Language:PowerShell1.9k184

• rod-trent/MustLearnKQL

  Code included as part of the MustLearnKQL blog series

  974164

• cyb3rmik3/KQL-threat-hunting-queries

  A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

  57666

• garybushey/ProgrammingMicrosoftSentinel

  Programming Microsoft Sentinel book

  223

• LearningKijo/KQL

  Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.

  44177

• dirkjanm/ROADtools

  A collection of Azure AD/Entra tools for offensive and defensive security purposes

  Language:Python1.9k269

• Gerenios/AADInternals

  AADInternals PowerShell module for administering Azure AD and Office 365

  Language:PowerShell1.3k217

• reprise99/Sentinel-Queries

  Collection of KQL queries

  1.4k338

• mevry/O365ManagementAPI

  Utility for interacting with the M365 Management API

  Language:PowerShell1

• jfjallid/go-secdump

  Tool to remotely dump secrets from the Windows registry

  Language:Go39642

• austinsonger/Incident-Playbook

  GOAL: Incident Response Playbooks Mapped to MITRE Attack Tactics and Techniques. [Contributors Friendly]

  1.4k246

• microsoft/MSLab

  Azure Stack HCI, Windows 10 and Windows Server rapid lab deployment scripts

  Language:PowerShell1.2k287

• cyb3rxp/awesome-soc

  A collection of sources of documentation, as well as field best practices, to build/run a SOC

  1.2k203

• frankwxu/digital-forensics-lab

  Free hands-on digital forensics labs for students and faculty

  Language:Jupyter Notebook1.6k369

• cybergoatpsyops/detections

  Placeholder for my detection repo and misc detection engineering content

  Language:Jupyter Notebook434

• Yamato-Security/hayabusa

  Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

  Language:Rust2.3k201

• dr4k0nia/tooling-playground

  A collection of small scripts and tools for deobfuscation and malware analysis.

  Language:C#653

• nathanmcnulty/nathanmcnulty

  Language:PowerShell767

• Bert-JanP/Hunting-Queries-Detection-Rules

  KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

  Language:Python1.2k230

• cisagov/decider

  A web application that assists network defenders, analysts, and researchers in the process of mapping adversary behaviors to the MITRE ATT&CK® framework.

  Language:HTML1.1k117

• correlatedsecurity/Awesome-SOAR

  A curated Cyber "Security Orchestration, Automation and Response (SOAR)" awesome list.

  806131

• Azure/Azure-Sentinel-Notebooks

  Interactive Azure Sentinel Notebooks provides security insights and actions to investigate anomalies and hunt for malicious behaviors.

  Language:Jupyter Notebook556191

• jsecurity101/TelemetrySource

  22118