NetLlix

NetLlix A project created with an aim to emulate and test exfiltration of data over different network protocols. The emulation is performed w/o the usage of native API's. This will help blue teams write correlation rules to detect any type of C2 communication or data exfiltration. Currently, this...

MalwLess

MalwLess Simulation Tool MST MalwLess is an open source tool that allows you to simulate system compromise or attack behaviours without running processes or PoCs. The tool is designed to test Blue Team detections and SIEM correlation rules. It provides a framework based on rules that anyone can...

titus

Titus: High-Performance Secrets Scanner Titus is a high-performance secrets scanner that detects credentials, API keys, and tokens in source code, files, and git history. It ships with 487 detection rules covering hundreds of services and credential types, drawn from NoseyParker and Kingfisher...

DefaultCreds-cheat-sheet

Default Credentials Cheat Sheet One place for all the default credentials to assist pentesters/blue Teamers during engagements, featuring default login/password details for various products sourced from multiple references. P.S : Most of the credentials were extracted from changeme,routersploit a...

Threat_Hunting

ThreatHunting Some Crowdstrike threat hunting queries useful for blue teamers and threat hunters...

matrix-rs

Windows Kernel Blue Pill Type-2 Hypervisor in Rust Codename: Matrix Blog: https://memn0ps.github.io/hypervisors-for-memory-introspection-and-reverse-engineering/ A lightweight, memory-safe, and blazingly fast Rust-based type-2 research hypervisor with hooks for Intel VT-x, focused on studying the...

RedELK

RedELK The Red Team's SIEM - a tool for Red Teams for tracking and alarming about Blue Team activities as well as enhanced usability in long term operations. 1. Enhanced usability and overview for the red team operators by creating a central location where all relevant operational logs from...

scour

Scour - AWS Detection Framework This tool is used to emulate attack patterns inside of the AWS Controlplane. Each attack is tagged with a specific UA for the blue team to signal off of. Status This is still an active work in progress. Lots of Bugs Not ready for production Where to file issues :...

f8x

A brand-new IaC automated deployment tool RedC, built on Terraform + Wails GUI for automated multi-cloud deployment and project orchestration—give it a try! Red/Blue team environment automation deployment tool Start • Options • Example • FAQ • License English | 简体中文 WgpSec Infra Ecosystem Within...

RTA

Red Team Automation RTA RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK. RTA is composed of python scripts that generate evidence of over 50 different ATT&CK tactics, as well as a compil...

awesome-cybersecurity-blueteam

Awesome Cybersecurity Blue Team A collection of awesome resources, tools, and other shiny things for cybersecurity blue teams. Cybersecurity blue teams are groups of individuals who identify security flaws in information technology systems, verify the effectiveness of security measures, and monit...

BlueTeam-Tools

BlueTeam-Tools This github repository contains a collection of 70+ tools and resources that can be useful for blue teaming activities. Some of the tools may be specifically designed for blue teaming, while others are more general-purpose and can be adapted for use in a blue teaming context. 🔗 If...

sheepl

sheepl Sheepl : Creating realistic user behaviour for supporting tradecraft development within lab environments Introduction There are lots of resources available online relating to how you can build AD network environments for the development of blue team and red team tradecraft. However the...

Scanners-Box

English | 简体中文 | Español Introduction EN The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents 中文 面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵 ES El arsenal definitivo de seguridad de código abierto para hackers, empresas y agentes de IA !TIP 📅 Tired of hunting all over the place for ...

Invoke-Obfuscation

Invoke-Obfuscation v1.8 Introduction Invoke-Obfuscation is a PowerShell v2.0+ compatible PowerShell command and script obfuscator. Background In the Fall of 2015 I decided to begin researching the flexibility of PowerShell's language and began cataloguing the various ways to accomplish a handful ...

Bashfuscator

Bashfuscator Documentation What is Bashfuscator? Bashfuscator is a modular and extendable Bash obfuscation framework written in Python 3. It provides numerous different ways of making Bash one-liners or scripts much more difficult to understand. It accomplishes this by generating convoluted,...

BeaconHunter

BeaconHunter Behavior based monitoring and hunting tool built in C leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons. Author :...

DumpsterFire

DumpsterFire Toolset DumpsterFire Toolset - "Security Incidents In A Box!" Update 05/27/2020: Yes, I'll be migrating all of my Github projects to Python3 over the summer of 2020. The DumpsterFire Toolset is a modular, menu-driven, cross-platform tool for building repeatable, time-delayed,...

chipwhisperer

ChipWhisperer Important Links Documentation | Labs | Forum | Store | NewAE ChipWhisperer 7.0: Revamped Analyzer, Project, SCA101 ChipWhisperer 7.0 is bringing major improvements to projects, analyzer, as well as a new online course, SCA101. These changes include: New Zarr based projects with...

redteam-plan

🔥 🚒 Planning a Red Team exercise This document helps inform red team planning by contrasting against the very specific red team style described in Red Teams. This method expresses several biases to optimize for blue team value and enthusiasm. It specifically avoids attempts to motivate by red tea...