sisu

sisu ⚡ Your AWS, as a filesystem. This: grep -l "AdministratorAccess" iam/users//policies.json Instead of this: aws iam list-users --query 'Users.UserName' --output text | \ xargs -I sh -c 'aws iam list-attached-user-policies --user-name --query "AttachedPolicies.PolicyArn" --output text' | \ gre...

Credential-and-breach-monitoring

Breach / Stealer-Log / Identity Exposure Services Comparison with Scoring This document compares breach intelligence, dark web monitoring, and identity exposure services across practical dimensions relevant to modern security teams. It focuses on: Breach corpus depth Infostealer-log coverage API...

killshot

This project is no longer maintained ! KILLSHOT A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner Why KillShot? You can use this tool to spider your website, gather important information, and automate data collection using tools such as WhatWeb, Host,...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

EDRaser

EDRaser Usage Guide EDRaser is a powerful tool for remotely deleting access logs, Windows event logs, databases, and other files on remote machines. It offers two modes of operation: automated and manual. Automated Mode In automated mode, EDRaser scans the C class of a given address space of IPs...

ThreatHound

ThreatHound ThreatHound is an advanced cybersecurity tool designed to facilitate efficient threat detection and analysis, windows events logs. it offers a user-friendly interface for managing and analyzing security data. Key features include log analysis, Sigma rule integration, and real-time...

Malcolm

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

bucket-stream

🚨 Bucket Stream is no longer maintained. If you need support or consultation for your red teaming endeavours, drop me an e-mail [email protected] 🚨 Bucket Stream Find interesting Amazon S3 Buckets by watching certificate transparency logs. This tool simply listens to various certificate...

terraform-aws-secure-baseline

terraform-aws-secure-baseline Terraform Module Registry A terraform module to set up your AWS account with the reasonably secure configuration baseline. Most configurations are based on CIS Amazon Web Services Foundations v1.4.0 and AWS Foundational Security Best Practices v1.0.0. See Benchmark...

uac

Unix-like Artifacts Collector UAC About • Documentation • Main Features • Supported Operating Systems • Usage • Contributing • Support • License 🔎 About UAC UAC Unix-like Artifacts Collector is a powerful and extensible incident response tool designed for forensic investigators, security analysts...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

kippo

NOTE: For more recent development, check out Michel Oosterhof's fork Kippo Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker. Kippo is inspired, but not based on Kojoney. Demo Some interesti...

evtx

EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...

epagneul

epagneul Epagneul is a tool to visualize and investigate windows event logs. Deployment Requires docker and docker-compose to be installed. Installing make Offline deployment On a machine connected to internet, build an offline release: make release This will create a release folder containing...

third-thoughts

Third Thoughts A Lightless Labs research project studying AI agent behavior at scale through multi-disciplinary corpus analysis basically, throwing stuff at the wall and seeing what sticks. Named after Tiffany Aching's concept from Discworld: first thoughts agents thinking, second thoughts agents...

RedELK

RedELK The Red Team's SIEM - a tool for Red Teams for tracking and alarming about Blue Team activities as well as enhanced usability in long term operations. 1. Enhanced usability and overview for the red team operators by creating a central location where all relevant operational logs from...

reversemap

reversemap Analyse SQL injection attempts in web server logs The program can either be run in batch mode or interactive mode. In batch mode the program will accept Apache web server logs and will deobfuscate requested URLs from the logs. In interactive mode the program will prompt for user input...

Ghost-In-The-Logs

Ghost In The Logs This tool allows you to evade sysmon and windows event logging, my blog post about it can be found here Usage You can grab the lastest release here Starting off Once you've got the latest version execute it with no arguments to see the avalible commands $ gitl.exe Loading the ho...

csf

ArmourBird CSF - Container Security Framework Note: The CSF Client is under active development and is getting converted into GoLang for better performace and architecture Table of Contents 1. About 2. Architecture Diagram 3. APIs-CSF Server 4. Installation/Usage 5. Building Docker Images 6. Sneak...