Nasreddine Bencherchali

EVTX-ETW-Resources. Event Tracing For Windows (ETW) Resources

MindMaps. #ThreatHunting #DFIR #Malware #Detection Mind Maps

SIGMA-Resources. Resources To Learn And Understand SIGMA Rules

Misc-Research. A collection of tools, scripts and personal research

C2-Matrix-Indicators. This repository aims to collect and document indicators from the different C2's listed in the C2-Matrix

Eventlog_Compendium. The Eventlog Compendium is the go-to resource for understanding Windows Event Logs.

SEDR-Internals. Symantec EDR Internals

procmon-malware-analysis-filters. Repository containing malware analysis filters for the Windows SysInternals' - Process Monitor tool

Multi-Threaded-BruteForcer. A script that automates a brute-force attack on a login page

Awesome-Detection-Engineering. Resources and Discussions About Detection Engineering

sigma. Generic Signature Format for SIEM Systems

sedr-localdatastore-parser. Parser for Symantec EDR "localdatastore" folder

Encoder-Decoder. A python script that contains multiple functionalities (Hashing, Encoding/Decoding...etc.)

LOLDrivers. Living Off The Land Drivers

DefenderYara. Extracted Yara rules from Windows Defender mpavbase and mpasbase

Slides. A collection of my slides and presentations

Ransomware-Tool-Matrix. A resource containing all the tools each ransomware gangs uses

BigBountyRecon. BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation.

LawEnforcementResources. Resources provided by the community that can serve to be useful for Law Enforcement worldwide

awesome-event-ids. Collection of Event ID ressources useful for Digital Forensics and Incident Response

DFIRPowerShellScripts. Various PowerShells scripts I've made to automate some of the boring stuff in my everyday DFIR journey!

LOLRMM. LotL RMM

winevt-kb. Windows Event Log Knowledge Base

atomic-red-team. Small and highly portable detection tests based on MITRE's ATT&CK.

sysmon-config. Sysmon configuration file template with default high-quality event tracing

wil. Windows Implementation Library

SysmonCommunityGuide. TrustedSec Sysinternals Sysmon Community Guide

Zircolite. A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

droid. A pySigma wrapper to manage detection rules.

threathunters. YARA

The_Shelf. Retired TrustedSec Capabilities

detection-rules. Python

NimPlant. A light-weight first-stage C2 implant written in Nim.

LOLBAS. Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

MAL-CL. MAL-CL (Malicious Command-Line)

CVE-2019-19547. CVE-2019-19547​ POC

CVE-2020-12593. CVE-2020-12593 POC

SIGMA-detection-rules. Set of SIGMA rules (>320) mapped to MITRE ATT&CK tactic and techniques

VanillaWindowsReference. A repo that contains recursive dir listings of a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update.

pySigma-backend-elasticsearch. pySigma Elasticsearch backend

panopticon. A YARA Rule Performance Measurement Tool