monkey365

...

log-horizon

Microsoft Sentinel SIEM Log Source Analyzer I've had to answer "what are we actually getting out of these logs?" or "what is the recommended logs for Microsoft Sentinel" more times than I can count. The answer always depend on so many things, but we can be generic. So I built this thingy right...

ADLab

ADLab PowerShell Module Introduction The purpose of this module is to automate the deployment of an Active Directory lab for practicing internal penetration testing. Credits to Joe Helle and his PowerShell for Pentesters course regarding the generation of the attack vectors. Instructions...

Posh-SSH

Posh-SSH Description Windows Powershell module that leverages a custom version of the SSH.NET Library to provide basic SSH functionality in Powershell. The main purpose of the module is to facilitate automating actions against one or multiple SSH enabled Linux servers from a Windows Host. As of...

PS2EXE

AI free repository - artificial intelligence is killing creativity and our nature! PS2EXE Overworking of the great script of Ingo Karstein with GUI support. The GUI output and input is activated with one switch, real windows executables are generated. Compiles only Powershell 5.x compatible...

Invoke-SocksProxy

Invoke-SocksProxy Creates a local or "reverse" Socks proxy using powershell. The local proxy is a simple Socks 4/5 proxy. The reverse proxy creates a tcp tunnel by initiating outbond SSL connections that can go through the system's proxy. The tunnel can then be used as a socks proxy on the remote...

AzureRT

AzureRT Powershell module implementing various cmdlets to interact with Azure and Azure AD from an offensive perspective. Helpful utilities dealing with access token based authentication, switching from Az to AzureAD and az cli interfaces, easy to use pre-made attacks such as Runbook-based comman...

Azur3Alph4

Azur3Alph4 About Azur3Alph4 is a PowerShell module that automates red-team tasks for ops on objective. This module situates in a post-breach RCE achieved position. Token extraction and many other tools will not execute successfully without starting in this position. This module should be used for...

GPOZaurr

GPOZaurr Пожиратель групповых политик Group Policy Eater — это модуль PowerShell, предназначенный для сбора информации о групповых политиках, а также для устранения проблем, которые могут быть в них обнаружены. GPOZaurr предоставляет полную информацию о групповых политиках и их настройках. Всего...

AADInternals

AADInternals AADInternals is PowerShell module for administering Azure AD and Office 365 For details, please visit https://aadinternals.com/aadinternals Installation Run the following PowerShell command to install root@kitploit: Install-Module AADInternals...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI — модуль PowerShell для поиска угроз через журналы событий Windows Eric Conrad, Backshore Communications, LLC deepblue собака backshore точка net Twitter: @ericconrad http://ericconrad.com Образцы файлов EVTX находятся в каталоге .\evtx Примечание: Если ваш антивирус сходи...

HoneypotBuster

Microsoft PowerShell module designed for red teams that can be used to find honeypots and honeytokens in the network or at the host. CodeExecution Execute code on a target machine using Import-Module. Invoke-HoneypotBuster HoneypotBuster is a tool designed to spot Honey Tokens, Honey Bread Crumbs...

DFIR-O365RC

Содержание: 1. Описание модуля 2. Установка и предварительные требования 1. Использование Docker 2. Ручная установка 3. Управление приложением DFIR-O365RC 1. Создание приложения 2. Обновление приложения 3. Удаление приложения 4. Требования к разрешениям и лицензиям 5. Функции, включённые в модуль...

Get-PDInvokeImports

Get-PDInvokeImports Description: Get-PDInvokeImports is tool PowerShell module which is able to perform automatic detection of P/Invoke, Dynamic P/Invoke and D/Invoke usage in assembly. Showing all locations from where they are referenced and Exports all to DnSpyBookmarks.xml This PS module could...

PowerShellArsenal

PowerShellArsenal is a PowerShell module used to aid a reverse engineer. The module can be used to disassemble managed and unmanaged code, perform .NET malware analysis, analyze/scrape memory, parse file formats and memory structures, obtain internal system information, etc. PowerShellArsenal is...

ADModule

ADModule Microsoft signed DLL for the ActiveDirectory PowerShell module Just a backup for the Microsoft's ActiveDirectory PowerShell module from Server 2016 with RSAT and module installed. The DLL is usually found at this path:...

DET

DET extensible Data Exfiltration Toolkit DET is provided AS IS, is a proof of concept to perform Data Exfiltration using either single or multiple channels at the same time. This is a Proof of Concept aimed at identifying possible DLP failures. This should never be used to exfiltrate sensitive/li...

RiskySPN

RiskySPNs RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs Service Principal Name. This module can assist blue teams to identify potentially risky SPNs as well as red teams to escalate privileges by leveraging Kerberos and Active...

Invoke-ArgFuscator

░█░█▄░█░█▒█░▄▀▄░█▄▀▒██▀░▒░ ▄▀▄▒█▀▄░▄▀▒▒█▀░█▒█░▄▀▀░▄▀▀▒▄▀▄░▀█▀░▄▀▄▒█▀▄░ ░█░█▒▀█░▀▄▀░▀▄▀░█▒█░█▄▄░▀▀░█▀█░█▀▄░▀▄█░█▀░▀▄█▒▄██░▀▄▄░█▀█░▒█▒░▀▄▀░█▀▄░ Invoke-ArgFuscator Invoke-ArgFuscator — это открытый кроссплатформенный модуль PowerShell, который помогает генерировать обфусцированные командные строки д...

TokenTactics

TokenTactics Azure JSON Web Token "JWT" Manipulation Toolset Azure access tokens allow you to authenticate to certain endpoints as a user who signs in with a device code. Even if they used multi-factor authentication. Once you have a user's access token, it may be possible to access certain apps...