Rahmat Nurfauzi

Red-Teaming-Toolkit. This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

AD-Attack-Defense. Attack and defend active directory using modern post exploitation adversary tradecraft activity

awesome-mitre-attack. A curated list of awesome resources related to Mitre ATT&CK™ Framework

MaliciousMacroMSBuild. Generates Malicious Macro and Execute Powershell or Shellcode via MSBuild Application Whitelisting Bypass.

red-team-scripts. A collection of red teaming and adversary emulation related tools, scripts, techniques, notes, etc

SharpDoor. SharpDoor is alternative RDPWrap written in C# to allowed multiple RDP (Remote Desktop) sessions by patching termsrv.dll file.

VeilTransfer. VeilTransfer is a data exfiltration utility designed to test and enhance the detection capabilities. This tool simulates real-world data exfiltration techniques used by advanced threat actors, allowing organizations to evaluate and improve their security posture.

ycsm. This is a quick script installation for resilient redirector using nginx reverse proxy and letsencrypt compatible with some popular Post-Ex Tools (Cobalt Strike, Empire, Metasploit, PoshC2).

TTPMapper. TTPMapper is an AI-driven threat intelligence parser that converts unstructured reports whether from web URLs or PDF files into structured intelligence. Using the DeepSeek LLM, it extracts MITRE ATT&CK techniques, IOCs, threat actors, and generates contextual summaries.

Invoke-AtomicAssessment. Invoke-AtomicAssessment is a powerful tool designed to facilitate adversary emulation by leveraging Atomic Red Team.

e2modrewrite. Convert Empire profiles to Apache mod_rewrite scripts

Red-Team-Infrastructure-Wiki. Wiki to collect Red Team infrastructure hardening resources

awesome-threat-detection. A curated list of awesome threat detection and hunting resources

awesome-threat-intelligence. A curated list of Awesome Threat Intelligence resources

Seatbelt. Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

PayloadsAllTheThings. A list of useful payloads and bypass for Web Application Security and Pentest/CTF

SecLists. SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

atomic-red-team. Small and highly portable detection tests.

C3. Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.

DeTTECT. Detect Tactics, Techniques & Combat Threats

ThreatHunter-Playbook. A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.

infosecn1nja.

Empire. Empire is a PowerShell and Python post-exploitation agent.

HELK. The Hunting ELK

BloodHound. Six Degrees of Domain Admin

Malleable-C2-Profiles. Cobalt Strike - Malleable C2 Profiles. A collection of profiles used in different projects using Cobalt Strike https://www.cobaltstrike.com/.

CyberChef. The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

Veil. Veil 3.1.X (Check version info in Veil at runtime)

LOLBAS. Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

AggressorScripts. Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

ATTACK. MITRE ATT&CK Windows Logging Cheat Sheets

MaliciousMacroGenerator. Malicious Macro Generator

domainhunter. Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names

ThreatHunting. An informational repo about hunting for adversaries in your IT environment.

PoshC2_Python. Python Server for PoshC2

metasploit-framework. Metasploit Framework

sigma. Generic Signature Format for SIEM Systems

Rubeus. Trying to tame the three-headed dog.

indonesian-wordlist. Indonesian wordlist useful for password cracking

Egress-Assess. Egress-Assess is a tool used to test egress data detection capabilities

persistence-aggressor-script. initial commit

sliver. Adversary Emulation Framework