randomrhythm Goto Github PK

adfs_analysis

AD FS research

awesome-threat-intelligence

A curated list of Awesome Threat Intelligence resources

capev2

Malware Configuration And Payload Extraction

cbc_vuln_assessment

This script will take the CSV output and create a CSV with endpoints grouped by CVE and one with NVD descriptions

cbinterface

command line tool for interfacing with multiple carbonblack environments to perform analysis and live response functions

cisco_amp_prevalence

Export file prevalence from AMP for Endpoints

combinespreadsheets

Combine all columns from two Microsoft Excel spreadsheets into one based on matching column values

convertdns

Converts dns names to Microsoft DNS debug format. Example: google.com becomes (6)google(3)com(0)

csv_condense

Select key columns in the CSV to track unique values and produce a condensed output

csv_reader

CSV Reader for VBScript. Parses cell values from CSV data.

cuckoo-modified

Modified edition of cuckoo

cylance_optics_yara

PoC YARA scanner for Cylance Optics using .net YARA DLL via IronPython

divide-and-write

split file based on division

dnsclientcom

COM object for performing DNS queries / lookups

evtxtoelk

A lightweight tool to load Windows Event Log evtx files into Elasticsearch.

goldenspy-yara-iocs

Loki-compatible YARA-rules and IoC lists for GoldenSpy

judge-jury-and-executable

File system forensics analysis and threat hunting tool. Scans file systems at the MFT and OS level and stored in SQL. Threats and data can be probed harnessing the power and syntax of SQL.

key-value_pair_condense

Condense files from a key-value pair format into a CSV with choosen key-values

levelupdomain

Takes a list of domains and output one unique domain structure for each unique second (or third) level domain

mal2csv

Malformed Access Log to CSV - Convert Web Server Access Logs to CSV

maltrail

Malicious traffic detection system

merge-iis-logs

Merge IIS logs into one big file

mergecsvfiles

mitre-json2csv

Convert enterprise-attack.json into a CSV format

nvd-cve-api

Wrapper to fetch cve information from NVD

oracle_weblogic_log_baseline

Baseline WebLogic application logs to find suspicious activity such as shell sessions.

parse-attk

Trend Micro Anti-Threat Toolkit output parser

phpids

PHPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web application

powershellblacklist

List of PowerShell commands and commandlets that should be in your Powershel watchlist

process_tor

Process a CSV of tor alerts against the www.dan.me.uk/tornodes list to confirm if the IP and port are listed.