Olaf Hartong

sysmon-modular. A repository of sysmon configuration modules

ThreatHunting. A Splunk app mapped to MITRE ATT&CK to guide your threat hunts

sysmon-cheatsheet. All sysmon event types and their fields explained

ATTACKdatamap. A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

BamboozlEDR. A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.

DefenderHarvester. Expose a lot of MDE telemetry that is not easily accessible in any searchable form

MDE-AuditCheck. MDE relies on some of the Audit settings to be enabled

Presentations. My conference presentations

ETWLocksmith. A powerful Windows command-line tool for analyzing and searching ETW (Event Tracing for Windows) provider permissions from the Windows registry.

PockETWatcher. a tiny program to consume from ETW providers for research

detection-sources.

BHCEupload. A small go tool to upload JSON files to the BloodHound community edition API

TA-Sysmon-deploy. Deploy and maintain Symon through the Splunk Deployment Sever

WDACme. A WDAC configuration repository with the sole intention of enriching MDE

sysmon-parser. Automatically generated Sysmon parser for Azure Sentinel

sysmon-modular-linux. A repository of Sysmon For Linux configuration modules

parsoalto. Palo Alto Networks Rule Parser

Sentinel-template-parser. Azure Sentinel Template parser

SA-Threat-Hunting. Splunk app for Threat hunting

PSSysmonTools. Sysmon Tools for PowerShell

Invoke-Phant0m. Windows Event Log Killer

ETWhat. ETWhat is a Windows utility that determines whether Event Tracing for Windows (ETW) providers operate in kernel mode or user mode.

unfetter-discover. Unfetter-Discover Vagrant script for the Unfetter-Discover docker release

osx-defaults. All my default config stuff for mac

DetectionLab. Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices

ETWtop. A real-time monitoring tool for Event Tracing for Windows (ETW) session buffers

scripts. just random simple scripts

SysmonCommunityGuide. TrustedSec Sysinternals Sysmon Community Guide

provmon. A specialized ETW (Event Tracing for Windows) monitoring tool that traces the Microsoft-Windows-Kernel-EventTracing provider for Event ID 8.

sysmon-dfir. Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.

blackhat-arsenal-tools. Official Black Hat Arsenal Security Tools Repository

olafhartong.

disposable-windows. A packer project to quickly have a test / dev / IR box

ETW-DBG-ENUM. Enumerates all ETW sessions from kernel structures

splunk-jupyter. Analyse your Splunk data from a Jupyter Notebook, as a Pandas Dataframe.

TA-microsoft-sysmon. TA-microsoft-sysmon

Event-Forwarding-Guidance. Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. iadgov

subTee-gits-backups. subTee gists code backups

LOLDrivers. Living Off The Land Drivers

SplunkTools. A collection of scripts useful in management of Splunk deployment

SomeStuff. Some PowerShell Stuff

Azure-Sentinel. Cloud-native SIEM for intelligent security analytics for your entire enterprise.

sysmon-splunk-app. Sysmon Splunk App

flushwifi. a simple script written for OSX to restart all network interfaces, clear ARP cache, and flush routes. also includes MAC randomization and protection from ICMP redirect attacks.

ARTHIR. ATT&CK Remote Threat Hunting Incident Response

sigma. Generic Signature Format for SIEM Systems

OSSEM-DM. OSSEM Detection Model

raycast-extensions. Everything you need to extend Raycast.

RTA. Python

cti. Cyber Threat Intelligence Repository expressed in STIX 2.0

BloodHound. Six Degrees of Domain Admin