Fabian Bader

TokenTacticsV2. A fork of the great TokenTactics with support for CAE and token endpoint v2

MSRC-PatchReview. A PowerShell variant of the amazing patch_review.py by kevthehermit

DefenderAndSentinelQueries. Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources.

SentinelARConverter. Sentinel Analytics Rule converter PowerShell module

EntraIDAuditLogToMicrosoftGraph. A list of Entra ID (Azure AD) Audit event names and the corresponding Microsoft Graph Request Uri

EntraIDPasskeyHelper. PowerShell module to manage the Entra ID device-bound passkey feature

XDRStoryParser. Visualize Microsoft Defender XDR process trees and security events

SentinelPesterFramework. Check you Sentinel environment using Pester infrastructure tests

GPOReport. A PowerShell function to search for specific group policy settings in all GPOs in a large enterprise environment

entrascopes.com. HTML

EntraID-ErrorCodes. Entra ID (Azure AD) error codes as JSON

AzAutomation-PoshACME. Automatically create and renew Let’s Encrypt certificates using Azure Automation and the Posh-ACME module

PowerShell-Script-Evolution. The example scripts show the evolution of a basic PowerShell script to a simple module

Microsoft-365-Defender-Hunting-Queries. Sample queries for Advanced hunting in Microsoft 365 Defender

SentinelSampleCICDRepo. PowerShell

Sentinel-Queries. Collection of KQL queries

XDRSchemaDocs. A website tracking the table schema of Microsoft XDR tables

CloudArchitektAzureSentinel. Sharing my KQL queries for Azure Sentinel

PurpleElbeSecurityUserGroup. Purple Elbe Security User Group

Azure-Sentinel. Cloud-native SIEM for intelligent security analytics for your entire enterprise.

FORK-family-of-client-ids-research. Research into Undocumented Behavior of Azure AD Refresh Tokens

KQLAnalyzer. REST server that can analyze Kusto KQL queries against the Sentinel and Microsoft 365 Defender schemas.

AADInternals. AADInternals PowerShell module for administering Azure AD and Office 365

DefenderHarvester. Expose a lot of MDE telemetry that is not easily accessible in any searchable form

Pass-the-Hash-Guidance. Configuration guidance for implementing Pass-the-Hash mitigations. #nsacyber

posh-dsc-windows-hardening. Windows OS Hardening with PowerShell DSC

MDE-AuditCheck. MDE relies on some of the Audit settings to be enabled

Office365NetworkTools. A collection of tools, scripts, code and documentation for Office 365 Network Routing, Optimization and Monitoring.

monkey365. Monkey365 provides a tool for security consultants to easily conduct not only Microsoft 365, but also Azure subscriptions and Azure Active Directory security configuration reviews.

evilginx2. Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

Posh-ACME. ACME v2 protocol client for generating certificates using Let's Encrypt (or other ACME v2 compliant CA)

adsec. An introduction to Active Directory security

ConditionalAccessDocumentation. Azure AD Conditional Access Documentation with PowerShell

ForgeCert. "Golden" certificates

SimpleSMTPClient. Simple SMTP Windows Client for Testing SMTP Server

sysmon-config. Sysmon configuration file template with default high-quality event tracing

azure-docs. PowerShell

Fork-PoCEntraDeviceComplianceBypass. Simple pure PowerShell POC to bypass Entra / Intune Compliance Conditional Access Policy

MDTI-Solutions. Repository to publish sample use cases, templates, solutions, automations for Microsoft Defender Threat Intelligence (MDTI) product

validate-detections. GitHub action for validating Microsoft Sentinel detection rules

microsoft-365-docs. This repo is used to host the source for the Microsoft 365 documentation on https://docs.microsoft.com.

azureadexporter. PowerShell module to export a local copy of all Azure Active Directory configuration settings and objects.

DomainPasswordSpray. DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!

Amazing-Icon-Downloader. Easily find and download SVG icons from the Microsoft Azure portal.

GPRegistryPolicyParser. PowerShell