BlueTeam.Lab This project contains a set of Terraform and Ansible scripts to create an orchestrated BlueTeam Lab. The goal of this project is to provide the red and blue teams with the ability to deploy an ad-hoc detection...
S1EM – a SIEM with SIRP and Threat Intel, all in one Today, cyber-attacks are more numerous and cause damage to companies. Nevertheless, many software products exist to detect cyber threats. The S1EM solution...
CloudGraph CloudGraph is the free open-source universal GraphQL API and Cloud Security Posture Management (CSPM) tool for AWS, Azure, GCP, and K8s. With CloudGraph you get: Free and effortless compliance checks (i.e. CIS 1.2) Type-Safe asset inventories for all of your resources in...
AWS CloudSaga – Simulate security events in AWS AWS CloudSaga is for customers to test security controls and alerts within their Amazon Web Services (AWS) environment, using generated alerts based on security events seen...
Ghostbuster Eliminate dangling elastic IPs by performing analysis on your resources within all your AWS accounts. Ghostbuster obtains all the DNS records present in all of your AWS accounts (Route53), and can optionally take...
OWASP Coraza Web Application Firewall Welcome to OWASP Coraza WAF, Coraza is a golang enterprise-grade Web Application Firewall framework that supports Modsecurity’s seclang language and is 100% compatible with OWASP Core Ruleset. Coraza v2...
Mobile Malware Mimicking Framework The Mobile Malware Mimicking framework, or m3 in short, is built to easily and scalable emulate Android malware whilst using very few resources. One can create fake bots via the command-line interface....
melody Melody is a transparent internet sensor built for threat intelligence and supported by a detection rule framework which allows you to tag packets of interest for further analysis and threat monitoring. This tool...
Rogue Assembly Hunter Rogue Assembly Hunter is a utility for discovering ‘interesting’ .NET CLR modules in running processes. Background .NET is a very powerful and capable development platform and runtime framework for building and...
LunaSec LunaSec is a suite of security tools designed to protect sensitive data in web applications by adding just a few lines of code. LunaSec is an end-to-end security system designed to protect your...
logdata-anomaly-miner This tool parses log data and allows to define analysis pipelines for anomaly detection. It was designed to run the analysis with limited resources and the lowest possible permissions to make it suitable...
SysmonSimulator SysmonSimulator is an Open source Windows event simulation utility created in C language, that can be used to simulate most of the attacks using WINAPIs. This can be used by Blue teams for...
Defense / Malware Analysis / Reverse Engineering
by do son · Published January 3, 2022 · Last modified April 2, 2023
iMonitor iMonitor (Endpoint Behavior Analysis System – Then Open Source Procmon) is an endpoint behavior monitoring and analysis software based on iMonitorSDK. Provides monitoring of system behaviors such as processes, files, registry, and networks. Support...
iMonitorSDK iMonitorSDK is a development kit that provides system behavior monitoring for terminals and the cloud. Help industry applications such as security, management, and auditing can quickly implement necessary functions without worrying about underlying...
Mandiant Azure AD Investigator This repository contains a PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity. Some indicators are “high-fidelity” indicators of compromise, while other artifacts...
Secure Your Connection
