sentinelblue Goto Github PK

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

azure-sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

bicep

Bicep is a declarative language for describing and deploying Azure resources

bloodhound

Six Degrees of Domain Admin

crtgov

cve-2022-29072

** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process, NOTE: multiple third parties have reported that no privilege escalation can occur.

cve-2022-30190

Microsoft Sentinel analytic rule and hunting queries in ASIM for activity of MSDT and CVE-2022-30190.

deepbluecli

entraexporter

PowerShell module to export a local copy of an Entra (Azure AD) tenant configuration.

haloapi

PowerShell module for the Halo Service Solutions series of software products.

helk

The Hunting ELK

malware-samples

A collection of malware samples and relevant dissection information, most probably referenced from http://blog.inquest.net

microsoft-info

Repository hosting a list of Microsoft First party apps

microsoft-teams-emergency-operations-center

The Microsoft Teams Emergency Operations Center (TEOC) solution template leverages the power of the Microsoft 365 platform to centralize incident response, information sharing and field communications using powerful services like Microsoft Lists, SharePoint and more.

msticpy

Microsoft Threat Intelligence Security Tools

ossem

Open Source Security Events Metadata (OSSEM)

paths-filter

Conditionally run actions based on files modified by PR, feature branch or pushed commits

psscriptanalyzer

Download ScriptAnalyzer from PowerShellGallery

rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

scubagear

(Azure Gov and GCC High Supported). Automation to assess the state of your M365 tenant against CISA's baselines.

sentinel-attack

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

winget-autoupdate

WAU daily updates apps as system and notify connected users. (Allowlist and Blocklist support)

winget-cli-restsource

This project aims to provide a reference implementation for creating a REST based package source for the winget client.