Michael Haag

sysmon-dfir. Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.

PowerShell-Hunter. PowerShell tools to help defenders hunt smarter, hunt harder.

hunt-detect-prevent. Lists of sources and utilities utilized to hunt, detect and prevent evildoers.

ClickGrab. Finding ClickFix and FakeCAPTCHA like it's 1999

notes. Full of public notes and Utilities

ASRGEN. ASR Configurator, Essentials and Atomic Testing

CBR-Queries. Collection of useful, up to date, Carbon Black Response Queries

MSIXBuilder. MSIX Building Made Easy for Defenders

ShellSweep. ShellSweeping the evil.

sysmon-splunk-app. Sysmon Splunk App

app_splunk_sysmon_hunter. Splunk App to assist Sysmon Threat Hunting

NPM-Threat-Emulation. Helping defenders learn and validate npm supply-chain detections with safe atomic tests.

bookish-happiness. OG Atomic Red Team

SDDLMaker. The home of the SDDLMaker

AppLockerGen. AppLocker Policy Generator

SequelEyes. SQL, IIS, Oh My...

HeapLeakDetection. C++

CBResponse-Splunk-Hunting. Analyzing Carbon Black Response endpoint telemetry in Splunk

Splunk_CBER_App. Splunk Carbon Black Enterprise Response App

atomic-red-team. Small and highly portable detection tests based on MITRE's ATT&CK.

sigZap. SigZap is a Streamlit application designed to facilitate the search across multiple network signature sets at once.

UltimateAppLockerByPassList. The goal of this repository is to document the most common techniques to bypass AppLocker.

pentest-wiki. PENTEST-WIKI is a free online security knowledge library for pentesters / researchers. If you have a good idea, please share it with others.

WinTrace. Run Windows Trace cmdline

Sysmon-Threat-Intel.

PELoader. Load PE via XML Attribute

KrbRelayUp. KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).

MHaggis.

ModSecurity. ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

HackerArt. A collection of art inspired by the world of cybersecurity and hacking culture.

AppLockerInspector. Audits an AppLocker policy XML and reports weak/misconfigured/risky settings, including actual ACL checks.

BlackLotus. BlackLotus UEFI Windows Bootkit

subTee-gits-backups. subTee gists code backups

tomcat-jmxproxy-rce-exp. Apache Tomcat JMXProxy RCE

sigma. Generic Signature Format for SIEM Systems

amsi-tracer. Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) passed into AMSI during dynamic execution.

LLM. LLM tools and toys

attack_range. A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

webshells. Various webshells. We accept pull requests for additions to this collection.

Splunk_TA_bit9-carbonblack.