binarydefense Goto Github PK

artillery

The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.

auto-ossec

beacon-fronting

A simple command line program to help defender test their detections for network beacon patterns and domain fronting

binarydefense.fsharp.analyzers

Security analyzers for the FSharp (F#) language

binarydefense.github.io

binarydefense.junit.expecto.testlogger

borat-rat-plugin-emulators

.Net Libraries (DLLs) re-written from scratch that emulate the functionality of Borat RAT for defese testing purposes

community-threats

A place to share attack chains for testing people, process, and technology with the entire community. The largest, public library of adversary emulation and adversary simulation plans! #ThreatThursday

decloaker

A script that attempts to decloak symbiote activity, and some other LD_PRELOAD activity

ghidrarustdependenciesextractor

Ghidra script for extracting embedded Rust crate dependency strings from a compiled Rust binary

glyph-hunter

Python Flask web app that checks names for potential homoglyph characteristics and reports results in json format

goatrider

GoatRider is a simple tool that will dynamically pull down Artillery Threat Intelligence Feeds, TOR, AlienVaults OTX, and the Alexa top 1 million websites and do a comparison to a hostname file or IP file.

hiddentaskhunter

iceddecrypt

IcedID Decryption Tool

jsonwrapper

A Myriad plugin for generating statically typed lossless wrappers around JToken given a schema.

log4j-honeypot-flask

Internal network honeypot for detecting if an attacker or insider threat scans your network for log4j CVE-2021-44228

mining-pools

List of mining pool domain names for use in detection logic

otx-microsoft-logic-app

Microsoft Logic App for consuming Open Threat Exchange (OTX) data in Microsoft Sentinel / Log Analytics Workspace

rpcfirewall-logparsers

sigma

Generic Signature Format for SIEM Systems

sysmon-modular

A repository of sysmon configuration modules

threathuntingjupyternotebooks

yaramemoryscanner

Simple PowerShell script to enable process scanning with Yara.