forensicitguy Goto Github PK

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

clean-iislogs

PowerShell tools to remove IIS logs according to retention policy

clth-study-group

Scripts used for a Jupiter Broadcasting Command-Line Threat Hunting Study Group

csharp-runpe

Hide malware behind a legit process C#

find-logons

PowerShell tool to lookup AD user info and track down account lockouts in AD domain

forensicitguy.github.io

ForensicITGuy Blog

golang-temperature-converter-cli

handy-cti

Resources I've found useful for my CTI work

invoke-partyparrot

Bringing the Party Parrot to PowerShell

libpreloadvaccine

Whitelisting LD_PRELOAD libraries using LD_AUDIT

malware-analysis-tools

malware-analyst-crash-course

Malware Analyst Crash Course

psprofile

python-decoding-sensor-data

reverse-bytes

A simple Python 3 script to reverse the order of bytes in a file and write the result to a second.

rhh-md5

Calculate the PE Rich Header MD5 hash

salt-states

This repository maintains the SaltStack state files for the REMnux distro.

signature-base

YARA signature and IOC database for my scanners and tools

tools

Scripts and tools accompanying HP Threat Research blog posts and reports.

unprotect_submission

Repository to publish your evasion techniques and contribute to the project

vscode-attack

Visual Studio Code extension for MITRE ATT&CK

yara

The pattern matching swiss knife