Richie Cyrus

fastbook. The fastai book, published as Jupyter Notebooks

secretive. Protect your SSH keys with your Mac's Secure Enclave

prowler. Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

GuideToMastodon. An increasingly less-brief guide to Mastodon

esfriend. A minimal malware analysis sandbox for macOS

zui. Zui is a powerful desktop application for exploring and working with data. The official front-end to the Zed lake.

stenographer. Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com

pics. File formats dissections and more...

pe_tree. Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump in-memory PE files and reconstruct imports.

detection-rules. Python

docker-elk. The Elastic stack (ELK) powered by Docker and Compose.

Beat-the-Machine. Reverse engineering basics in puzzle form

cyberchef-recipes. A list of cyber-chef recipes and curated links

scala-style-guide. Databricks Scala Coding Style Guide

devrel. This repository contains the notebooks and presentations we use for our Databricks Tech Talks

JustEnoughScalaForSpark. A tutorial on the most important features and idioms of Scala that you need to use Spark's Scala APIs.

sinter. A user-mode application authorization system for MacOS written in Swift

ASM-Course. Assembly

gcp-iam-sentinel-examples. HCL

gcploit. These are tools we released with our 2020 defcon/blackhat talk https://www.youtube.com/watch?v=Ml09R38jpok

teslamate. A self-hosted data logger for your Tesla 🚘 [main maintainer=@JakobLichterfeld]

ProcMon-for-Linux. A Linux version of the Procmon Sysinternals tool

flare-floss. FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

capa. The FLARE team's open-source tool to identify capabilities in executable files.

bulk_extractor. This is the development tree. Production downloads are at:

MemProcFS. MemProcFS

BLUESPAWN. An Active Defense and EDR software to empower Blue Teams

Splunk-ETW. A Splunk Technology Add-on to forward filtered ETW events.

SwiftBelt. A macOS enumeration tool inspired by harmjoy's Windows-based Seatbelt enumeration tool. Author: Cedric Owens

macOSTools. macOS Offensive Tools

hollows_hunter. Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

class-dump. Generate Objective-C headers from Mach-O files.

attack-arsenal. A collection of red team and adversary emulation resources developed and released by MITRE.

Post-Reformat. A guide to setting up Windows and MacOS the way I like it

MBE. Course materials for Modern Binary Exploitation by RPISEC

DefenderCheck. Identifies the bytes that Microsoft Defender flags on.

Marvel-Lab. A collection of Powershell scripts that will help automate the build process for a Marvel domain.

dangerzone. Take potentially dangerous PDFs, office documents, or images and convert them to safe PDFs

defcon27_csharp_workshop. Writing custom backdoor payloads with C# - Defcon 27 Workshop

Pcaps.

OSSEM. Open Source Security Events Metadata (OSSEM)

DidierStevensSuite. Please no pull requests for this repository. Thanks!

sRDI. Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

OffensiveCSharp. Collection of Offensive C# Tooling

learn_gnuawk. Example based guide to mastering GNU awk

ysoserial.net. Deserialization payload generator for a variety of .NET formatters

pivpn. The Simplest VPN installer, designed for Raspberry Pi

WindowsEventLogMetadata. Event metadata collected across all manifest-based ETW providers on Window 10 1903

Crescendo. Crescendo is a swift based, real time event viewer for macOS. It utilizes Apple's Endpoint Security Framework.

Azure-Sentinel. Cloud-native SIEM for intelligent security analytics for your entire enterprise.

Import-Marvel. Powershell script and CSV file that allows you to import marvel characters into Active Directory

alerter. Send User Alert Notification on MacOS from the command-line.

sandbox-attacksurface-analysis-tools. Set of tools to analyze Windows sandboxes for exposed attack surface.

etl2pcapng. Utility that converts an .etl file containing a Windows network packet capture into .pcapng format.

bro-sysmon. How to Zeek Sysmon Logs!

fzf. :cherry_blossom: A command-line fuzzy finder

attack_range. A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

KQL. Kusto Query Language

PayloadsAllTheThings. A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Mythic. A collaborative, multi-platform, red teaming framework

MacShellSwift. Proof of concept MacOS post exploitation tool written in Swift. Designed as a POC for blue teams to build macOS detections. Author: Cedric Owens

ossem-power-up. A tool to assess data quality, built on top of the awesome OSSEM.

sigma. Main Sigma Rule Repository

grapl. Graph platform for Detection and Response

Windows-API-To-Sysmon-Events. A repository that maps API calls to Sysmon Event ID's.

goesf. Golang command line tool for the macOS Endpoint Security Framework

msticpy. Microsoft Threat Intelligence Security Tools

docs. documentations, slides decks...

siofra. Assembly

ProcessMonitor. Process Monitor Library (based on Apple's new Endpoint Security Framework)

WinTools. A collection of free miscellaneous Windows tools

EVTX-ATTACK-SAMPLES. Windows Events Attack Samples

Microsoft-365-Defender-Hunting-Queries. Sample queries for Advanced hunting in Microsoft 365 Defender

docker-stacks. Ready-to-run Docker images containing Jupyter applications

LIEF. LIEF - Library to Instrument Executable Formats (C++, Python, Rust)

EndpointSecurity. A module to expose the Endpoint Security library to Swift

sysmon-cheatsheet. All sysmon event types and their fields explained

Malcolm. Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

ScoutSuite. Multi-Cloud Security Auditing Tool

CRuntimeFunctionHooker. An example of hooking C functions at runtime

threadexec. A library to execute code in the context of other processes on iOS 11.

swift-package-manager. The Package Manager for the Swift Programming Language

Set-AuditRule. Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity

ParseZeekLogs. Utility for parsing Bro log files into CSV or JSON format

Security-Datasets. Re-play Security Events

darwin-xnu. Legacy mirror of Darwin Kernel. Replaced by https://github.com/apple-oss-distributions/xnu

KapeFiles. This repository serves as a place for community created Targets and Modules for use with KAPE.

Awesome-Red-Teaming. List of Awesome Red Teaming Resources

token-priv. Token Privilege Research

osx-re-101. A collection of resources for OSX/iOS reverse engineering.

SharpSploit. SharpSploit is a .NET post-exploitation library written in C#

Seatbelt. Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

zeek-osquery. Bro/Zeek integration with osquery

xnumon. monitor macOS for malicious activity

OSSEM. Open Source Security Events Metadata (OSSEM)

osquery. SQL powered operating system instrumentation, monitoring, and analytics.

osquery-extensions. osquery extensions by Trail of Bits

attack-navigator. Web app that provides basic navigation and annotation of ATT&CK matrices

macOS-Security-and-Privacy-Guide. Community guide to securing and improving privacy on macOS.

HELK. The Hunting ELK

RTA. Python

APTSimulator. A toolset to make a system look as if it was the victim of an APT attack

PowerKrabsEtw. PowerKrabsEtw is a PowerShell interface for doing real-time ETW tracing.

DetectionLab. Automate the creation of a lab environment complete with security tooling and logging best practices

atomic-red-team. Small and highly portable detection tests based on MITRE's ATT&CK.

ACE. Automated, Collection, and Enrichment Platform

PSReflect-Functions. Module to provide PowerShell functions that abstract Win32 API functions

LuLu. LuLu is the free open-source macOS firewall

RATDecoders. Python Decoders for Common Remote Access Trojans