Pinned Repositories
clog
C++ Logging with per-module levels and string hiding for release-mode
crow
C++11 lib for binary encoder/decoder. Like protobuf without needing .proto files
dnsparser
Simple C++ DNS payload parser
dnssniffer
Sniffer that extracts DNS data using libpcap in C++
etwrealtime
Example of real-time Windows ETW packet capture session
kafka.cr
crystal-lang wrapper around kafka C library
libntstat
C++ library for com.apple.network.statistics kernel events on MacOS/OS X/Darwin
libtls_cert_example
C++ example of pinned certs and LibreSSL libtls
osquery_aws_notes
Best Practices and Integration Testing osquery AWS Logger
ps-audit-scripts
Powershell scripts for setting local event log audit settings using auditpol.exe
packetzero's Repositories
packetzero/dnsparser
Simple C++ DNS payload parser
packetzero/libntstat
C++ library for com.apple.network.statistics kernel events on MacOS/OS X/Darwin
packetzero/kafka.cr
crystal-lang wrapper around kafka C library
packetzero/osquery_aws_notes
Best Practices and Integration Testing osquery AWS Logger
packetzero/crow
C++11 lib for binary encoder/decoder. Like protobuf without needing .proto files
packetzero/osq_config_report
A tool to generate hyperlinked static HTML from osquery configs and packs
packetzero/osquery
SQL powered operating system instrumentation, monitoring, and analytics.
packetzero/vsqlite_serialize
A self-contained C++ module for osquery-like applications to serialize results, determine differential results, and have flexible protocols.
packetzero/atomic-harness
A tool to run and validate telemetry for Atomic Red Team tests
packetzero/atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
packetzero/atomic-validation-criteria
packetzero/auditutils
packetzero/code1920
packetzero/conveyor
C++11 library : efficient event cache for osquery agent with multiple read cursor support
packetzero/csvtoker
Simple C++ CSV line parser
packetzero/diwebapp
packetzero/dyno
Dynamic C++ objects for osquery
packetzero/edarr-deps
packetzero/falco_builder_ubuntu
packetzero/fring_bench
Comparison of JSON vs Binary record encoding performance tests with fring
packetzero/go-atomicredteam
go-atomicredteam is a Golang application to execute tests as defined in the atomics folder of Red Canary's Atomic Red Team project (https://github.com/redcanaryco/atomic-red-team).
packetzero/gorm-test
packetzero/libetw
Simple C++ library for Windows ETW event access
packetzero/mason
Cross platform package manager for C/C++ apps
packetzero/notes
packetzero/prettysql
SQL Pretty printer using simplesql C++ library, with optional schema awareness
packetzero/simplesql
C++ library for parsing, evaluating simple SQLite queries and expressions
packetzero/third-party
All of the dependencies that osquery needs that don't have nice packages
packetzero/vsqlite
C++11 library for using sqlite3 with virtual tables
packetzero/yara
The pattern matching swiss knife