theflakes

Ultimate-Forensics-VM. Evolving directions on building the best Open Source Forensics VM

reg_hunter. Blueteam operational triage registry hunting/forensic tool.

sigma_to_wazuh. Convert Sigma rules to Wazuh rules

Evil_DLL. Simple DLL to test various injection methods.

Linux_Forensic_Harvester. Harvest Linux forensic data for operational triage of an event.

StoW. Sigma to Wazuh rule converter

fmd. Windows file metadata / forensic tool.

bro-large_uploads. Zeek

Windows_logs_hunting.

OS-defaults_research. Information pertaining to OS install defaults to baseline normal for a given OS.

security-onion-intel-scripts. Scripts for collecting/creating intel and/or modifying various SO intel files including OSSEC and Bro

security-onion-misc-scripts. Misc scripts for SO

jve. Cmd line utility that accepts json via standard in (piping) and extracts values from json fields.

quantuminsert. Quantum Insert

sysmon. Sysmon custom configs (template from SwitchOnSecurity)

ELSA. Python

bro-scripts. Various Bro scripts