Mehmet E.

Threat-Hunting-and-Detection. Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

RITA-J. Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.

ACCD. Active C&C Detector

Microsoft-Vulnerable-Driver-Block-Lists. Microsoft Vulnerable Driver Block Lists in CSV and JSON for SIEM lookups

Cheat-Sheets. Cheat sheets for threat hunting, detection and other stuff.

blue-teaming-with-kql. Repository with Sample KQL Query examples for Threat Hunting

Spartacus. Spartacus DLL Hijacking Discovery Tool

Real-CyberSecurity-Datasets. Public datasets to help you address various cyber security problems.

blueteam_homelabs. Great List of Resources to Build an Enterprise Grade Home Lab

azure-kql. Azure KQL (Kusto Query Language) tips, tricks and best practices for Threat Hunting, Blue Teaming, etc.

socbed. A Self-Contained Open-Source Cyberattack Experimentation Testbed

malware_training_vol1. Materials for Windows Malware Analysis training (volume 1)

GHOSTS. GHOSTS is a realistic user simulation framework for cyber simulation, training, and exercise

DefensiveSysmon. Repository for Defensive applications of Windows Sysmon

Microsoft-M365D-Hunting-Queries. Sample queries for Advanced hunting in Microsoft Threat Protection

SPEED-SIEM-Use-Case-Framework. Repository for SPEED SIEM Use Case Framework

TokenFinder. Tool to extract powerful tokens from Office desktop apps memory

pytune. Python

defcon33_silence_kill_edr. C++

OktaGinx.

SharpTokenFinder. C# implementation of TokenFinder. Steal M365 access tokens from Office Desktop apps

GraphAZAccess. Jupyter Notebook

msticpy. Microsoft Threat Intelligence Security Tools

CloudPentestCheatsheets. This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.

TripleCross. A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

labs_modern_malware_c2. labs_modern_malware_c2 Originally supporting Defcon workshop, will morph into Attack Defend for C2.

etw-event-dumper. C#

bind9_logparse_stat. A simple frequency analysis script for bind9 DNS query logs. Is able to analyze based on client IP address, DNS domain name, and DNS query type. Uses both regular expressions, and the Counter() dictionary from the Python collections module. Is written to demonstrate how useful the combination of a Counter() dictionary and regular expressions are.

alerting-detection-strategy-framework. A framework for developing alerting and detection strategies for incident response.

ml-qrg. Machine Learning Quick Reference Guide

hot-manchego. Macro-Enabled Excel File Generator (.xlsm) using the EPPlus Library.

Blackout. kill anti-malware protected processes using BYOVD

attack-flow. ATT&CK Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.

Ciphey. Automated decryption tool

Cyb3rMonk. Whoami