A tool that takes over Windows Updates to craft custom downgrades and expose past fixed vulnerabilities

Kernel mode WinDbg extension and PoCs for token privilege investigation.

A command-line productivity tool powered by AI large language models like GPT-4, will help you accomplish your tasks faster and more efficiently.

An ATT&CK Navigator layer displaying 50 of the most common TTPs seen during CTF challenges

ESXi security configuration audit.

A comprehensive list of all cyber security/ethical hacking/information security societies associated to universities within the UK.

The Jolly Executioner - a simple command execution proxy

smbclient-ng, a fast and user friendly way to interact with SMB shares.

BadZure orchestrates the setup of Azure AD tenants, populating them with diverse entities while also introducing common security misconfigurations to create vulnerable tenants with multiple attack …

Sentinel Logic Apps/Playbooks to automate enrichment, incident analysis and more.

A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID

A collection of Azure AD/Entra tools for offensive and defensive security purposes

A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.

SOAPHound is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADWS) protocol.

MDE Tester is designed to help testing various features in Microsoft Defender for Endpoint.

The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collecti…

Python script to analyze and extract all Security Groups information

Open-source tool to enforce privacy & security best-practices on Windows, macOS and Linux, because privacy is sexy

Galah: An LLM-powered web honeypot.

practical toolkit for cybersecurity and IT professionals. It features a detailed Linux cheatsheet for incident response

ScriptSentry finds misconfigured and dangerous logon scripts.

Collection of forensic tools

Python script to convert Sigma rules to Azure ARM templates for Sentinel-as-Code deployments.

God Mode Detection Rules

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs