Pinned Repositories
atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
Azure-Sentinel
Cloud-native SIEM for intelligent security analytics for your entire enterprise.
bicep
Bicep is a declarative language for describing and deploying Azure resources
CVE-2022-29072
** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process, NOTE: multiple third parties have reported that no privilege escalation can occur.
CVE-2022-30190
Microsoft Sentinel analytic rule and hunting queries in ASIM for activity of MSDT and CVE-2022-30190.
DeepBlueCLI
EntraExporter
PowerShell module to export a local copy of an Entra (Azure AD) tenant configuration.
malware-samples
A collection of malware samples and relevant dissection information, most probably referenced from http://blog.inquest.net
PSScriptAnalyzer
Download ScriptAnalyzer from PowerShellGallery
ScubaGear
(Azure Gov and GCC High Supported). Automation to assess the state of your M365 tenant against CISA's baselines.
Sentinel Blue's Repositories
sentinelblue/CVE-2022-29072
** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process, NOTE: multiple third parties have reported that no privilege escalation can occur.
sentinelblue/CVE-2022-30190
Microsoft Sentinel analytic rule and hunting queries in ASIM for activity of MSDT and CVE-2022-30190.
sentinelblue/Azure-Sentinel
Cloud-native SIEM for intelligent security analytics for your entire enterprise.
sentinelblue/EntraExporter
PowerShell module to export a local copy of an Entra (Azure AD) tenant configuration.
sentinelblue/PSScriptAnalyzer
Download ScriptAnalyzer from PowerShellGallery
sentinelblue/ScubaGear
(Azure Gov and GCC High Supported). Automation to assess the state of your M365 tenant against CISA's baselines.
sentinelblue/atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
sentinelblue/bicep
Bicep is a declarative language for describing and deploying Azure resources
sentinelblue/BloodHound
Six Degrees of Domain Admin
sentinelblue/CRTgov
sentinelblue/DeepBlueCLI
sentinelblue/malware-samples
A collection of malware samples and relevant dissection information, most probably referenced from http://blog.inquest.net
sentinelblue/rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
sentinelblue/HaloAPI
PowerShell module for the Halo Service Solutions series of software products.
sentinelblue/HELK
The Hunting ELK
sentinelblue/microsoft-info
Repository hosting a list of Microsoft First party apps
sentinelblue/Microsoft-Sentinel-SB-ASIM
Microsoft Sentinel Advanced Security Information Model (ASIM) schemas and parsers maintained by the Sentinel Blue SOC team.
sentinelblue/microsoft-teams-emergency-operations-center
The Microsoft Teams Emergency Operations Center (TEOC) solution template leverages the power of the Microsoft 365 platform to centralize incident response, information sharing and field communications using powerful services like Microsoft Lists, SharePoint and more.
sentinelblue/msticpy
Microsoft Threat Intelligence Security Tools
sentinelblue/OSSEM
Open Source Security Events Metadata (OSSEM)
sentinelblue/paths-filter
Conditionally run actions based on files modified by PR, feature branch or pushed commits
sentinelblue/sentinel-attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
sentinelblue/Winget-AutoUpdate
WAU daily updates apps as system and notify connected users. (Allowlist and Blocklist support)
sentinelblue/winget-cli-restsource
This project aims to provide a reference implementation for creating a REST based package source for the winget client.