Trending repositories for topic blueteam
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
🕵️♂️ Collect a dossier on a person by username from thousands of sites
One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️
GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Awesome list of keywords and artifacts for Threat Hunting sessions
ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup
WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.
A list of vulnerabilities or design flaws that Microsoft does not intend to fix. Since the number is growing, I decided to make a list. This list covers only vulnerabilities that came up in July 2021 ...
Awesome list of keywords and artifacts for Threat Hunting sessions
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
HardeningKitty - Checks and hardens your Windows configuration
One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
🕵️♂️ Collect a dossier on a person by username from thousands of sites
WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.
GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems
A list of vulnerabilities or design flaws that Microsoft does not intend to fix. Since the number is growing, I decided to make a list. This list covers only vulnerabilities that came up in July 2021 ...
The goal of this repository is to document the most common techniques to bypass AppLocker.
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
🕵️♂️ Collect a dossier on a person by username from thousands of sites
GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems
One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
Awesome list of keywords and artifacts for Threat Hunting sessions
HardeningKitty - Checks and hardens your Windows configuration
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup
Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀
WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.
Investigate malicious Windows logon by visualizing and analyzing Windows event log
BypassIT is a framework for covert malware delivery and post-exploitation using AutoIT for red / blue team self assessment.
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
The repository is a valuable resource for individuals looking to enhance their knowledge and skills in cybersecurity. It provides in-depth materials and guides for various cybersecurity domains.
Awesome list of keywords and artifacts for Threat Hunting sessions
Entropy scanner for Linux to detect packed or encrypted binaries related to malware. Finds malicious files and Linux processes and gives output with cryptographic hashes.
HardeningKitty - Checks and hardens your Windows configuration
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️
This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
🕵️♂️ Collect a dossier on a person by username from thousands of sites
GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems
One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
Attack Graph Visualizer and Explorer (Active Directory) ...Who's *really* Domain Admin?
A collection of awesome security hardening guides, tools and other resources
Rapidly Search and Hunt through Windows Forensic Artefacts
HardeningKitty - Checks and hardens your Windows configuration
Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Investigate malicious Windows logon by visualizing and analyzing Windows event log
A tool that shows detailed information about named pipes in Windows
BypassIT is a framework for covert malware delivery and post-exploitation using AutoIT for red / blue team self assessment.
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
Supporting materials for my "Intelligence-Led Adversarial Threat Modelling with VECTR" workshop
ClatsCracker is a versatile Python password-cracking tool supporting over 15 hash algorithms. It offers dictionary or brute-force attacks, adjustable threads, salted hash verification, a user-friendly...
Offline command line tool that searches for GTFOBins binaries that can be used to bypass local security restrictions in misconfigured systems.
yara detection rules for hunting with the threathunting-keywords project
The repository is a valuable resource for individuals looking to enhance their knowledge and skills in cybersecurity. It provides in-depth materials and guides for various cybersecurity domains.
Awesome list of keywords and artifacts for Threat Hunting sessions
Purpleteam scripts simulation & Detection - trigger events for SOC detections
A tool that shows detailed information about named pipes in Windows
This repository stores various roadmap(Mindmaps) for bug bounty Hunter, pentester, offensive(red team), defensive(blue team) and security Professional people
Sigma detection rules for hunting with the threathunting-keywords project
Slack Enumeration and Extraction Tool - extract sensitive information from a Slack Workspace
This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
A curated list of tools and resources that I use daily as a Purple-Team operator.
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
Attack Graph Visualizer and Explorer (Active Directory) ...Who's *really* Domain Admin?
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
ClatsCracker is a versatile Python password-cracking tool supporting over 15 hash algorithms. It offers dictionary or brute-force attacks, adjustable threads, salted hash verification, a user-friendly...
Offline command line tool that searches for GTFOBins binaries that can be used to bypass local security restrictions in misconfigured systems.
BypassIT is a framework for covert malware delivery and post-exploitation using AutoIT for red / blue team self assessment.
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
🕵️♂️ Collect a dossier on a person by username from thousands of sites
GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️
Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀
A collection of awesome security hardening guides, tools and other resources
Rapidly Search and Hunt through Windows Forensic Artefacts
ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Attack Graph Visualizer and Explorer (Active Directory) ...Who's *really* Domain Admin?
An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.
HardeningKitty - Checks and hardens your Windows configuration
TangGo测试平台是无糖信息技术有限公司集多年渗透测试实战经验设计和开发的国产化综合性测试平台，为软件测试、网络安全从业人员提供强大且易用的测试工具及多人协同的工作环境，主要用于Web站点的功能测试、安全测试和安全评估。
This repo shares blue team security notes and resources for detecting and preventing cyber attacks. Topics covered include email, file, log, malware, memory forensics, and packet analysis.
yara detection rules for hunting with the threathunting-keywords project
A curated list of tools and resources that I use daily as a Purple-Team operator.
This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
This repository stores various roadmap(Mindmaps) for bug bounty Hunter, pentester, offensive(red team), defensive(blue team) and security Professional people
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
Awesome list of keywords and artifacts for Threat Hunting sessions
The repository is a valuable resource for individuals looking to enhance their knowledge and skills in cybersecurity. It provides in-depth materials and guides for various cybersecurity domains.
Purpleteam scripts simulation & Detection - trigger events for SOC detections
🕵️♂️ Collect a dossier on a person by username from thousands of sites
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Sigma detection rules for hunting with the threathunting-keywords project
Generates logs of typical formats that would often be found in a SOC.
Hourly updated database of exploit and exploitation reports