jason-yung Goto Github PK

active_directory_advanced_threat_hunting

This repo is about Active Directory Advanced Threat Hunting

awesome-forensics

A curated list of awesome forensic analysis tools and resources

azurehunter

A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

blue-jupyter

Jupyter Notebooks for the Blue Team

chrome-profile-view

Python web app for previewing data in a Chrome Profile Folder

dfir-orc

Forensics artefact collection tool for systems running Microsoft Windows

dfis

Digital Forensic Investigative Scripts

dotnettojscript

A tool to create a JScript file which loads a .NET v2 assembly from memory.

erebusgate

ErebusGate for Nim Bypass AV/EDR

esxiaudit

ESXi security configuration audit.

forensic-artifact-automation

A collection of powershell scripts that are designed to be ran from a Microsoft Defender for Endpoint Live Response terminal, utilizing open-source tools, such as Kape (Kroll Artifact Parser and Extractor), to forensically acquire and process necessary artifact used in compromise assessments. Additional scripts provide pre-processing automation ca

getdomain

用于在渗透测试中实现一键式域名挖掘、过滤等操作，以主动和被动两种模式进行，全部是async异步实现并发搜索，速度快，涵盖了子域名、兄弟域名等大部分可能的域名资产搜集，很方便的扩展安全测试的广度、测试面，避免手动搜集的繁琐以及不全面。

havoc

The Havoc Framework

intune-remediations

I hope these Microsoft Intune Remediations inspire you to make your own!

invoke-dumpmdeconfig

PowerShell script to dump Microsoft Defender Config, protection history and Exploit Guard Protection History (no admin privileges required )

logontracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log

malwoverview

Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, InQuest and it is able to scan Android devices against VT.

mandiant-azure-ad-investigator

masterparser

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

microsoft-extractor-suite

A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.

osep-code-snippets

A repository with my notable code snippets for Offensive Security's PEN-300 (OSEP) course.

thisisjust.fyi

toolkit

A toolkit for the post-mortem examination of Docker containers from forensic HDD copies

wela

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

wh0arey0u.github.io

windows-kernel-exploits

windows-kernel-exploits Windows平台提权漏洞集合

wiskess_posh

WISKESS automates the Windows evidence processing for Incident Response investigations. Powershell version.