99 Open Source Blueteam Software Projects

A GUI/REST interface to find similarities in large sets (think: binaries). Based on ssdeep.

Windows Hardening settings and configurations

Blue Team Scripts

Unofficial third-party scripts, playbooks, and content for IBM QRadar & QRadar Community Edition.

Investigate malicious Windows logon by visualizing and analyzing Windows event log

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

Deceptive tradecraft should be fun and light, not stern and stressful. It is cool to be cute.

🍓📡🍍Monitor illegal wireless network activities. (Fake Access Points), (WiFi Threats: KARMA Attacks, WiFi Pineapple, Similar SSID, OPN Network Density etc.)

E-mails, subdomains and names Harvester - OSINT

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Test Blue Team detections without running any attack.

👨‍💻🕵🏻👩‍💻 Analyze user behavior against fake access points📡

Anti keylogger, anti screen logger... Strategy to protect with hookings or improve your sandbox with spyware detection... - Demo

GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems

Collect IPFIX / Netflow v9 Records and Ship them to RITA for Analysis

A collection of scripts I've written to help red and blue teams with malware persistence techniques.

A Control Panel Applet dropper project. It has a high success rate on engagements since nobody cares about .CPL files and you can just double click them.

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG files to see what an attacker did on a compromised host. It is extremely useful for a forensics team to extract timestamps after an attack on a host to collect evidences and perform further analysis.

This repository contains all the config files and scripts used for our Open Source Endpoint monitoring project.

A Lambda-powered Security Orchestration framework for AWS GuardDuty

A PowerShell module to deploy active directory decoy objects.

IOS/MAC Denial-Of-Service [POC/EXPLOIT FOR MASSIVE ATTACK TO IOS/MAC IN NETWORK]

Slack Enumeration and Extraction Tool - extract sensitive information from a Slack Workspace

ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup

A Solution For Cross-Platform Obfuscated Commands Detection presented on CIS2019 China. 动静态Bash/CMD/PowerShell命令混淆检测框架 - CIS 2019大会

A collection of awesome security hardening guides, tools and other resources

Simple powershell script to find living off land binaries and scripts on a system.

Utility for hunting UAC bypasses or COM/DLL hijacks that alerts on the exported function that was consumed.

ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.

Actionable analytics designed to combat threats based on MITRE's ATT&CK.

Designed to be installed on a fresh install of raspbian on a raspberry pi, by combining Respounder (Responder detection) and Artillery (port and service spoofing) for network deception, this tool allows you to detect an attacker on the network quickly by weeding out general noisy alerts with only those that matter.

BlueSploit is a DFIR framework with the main purpose being to quickly capture artifacts for later review.

An attmept to block malware before AV scans it.

PowerShell script to get domain mail info and control status such as MX, SPF, DKIM, DMARC and StartTLS.

Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets.

Collection of PowerShell functinos and scripts a Blue Teamer might use

This repository is created only for infosec professionals whom work day to day basis to equip ourself with uptodate skillset, We can daily contribute daily one hour for day to day tasks and work on problem statements daily, Please contribute by providing problem statements and solutions

This repository contains full code examples from the book Gray Hat C#

Contain code referred in https://www.securityinbits.com/

Search for Unix binaries that can be exploited to bypass system security restrictions.

Find cloud assets that no one wants exposed 🔎 ☁️

Is this IP a C2 server?

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

Snoop — инструмент разведки на основе открытых данных (OSINT world)

The simplest way to find how to report abusive domains

OSINT Bookmarks for Firefox / Chrome / Edge / Safari

A public repository for the #Secsuite project. Created & maintained by @ghostinthecable.

A PowerShell script to prevent Sysmon from writing its events

Monitoring your Slack workspaces for sensitive information

Bloodhound for Blue and Purple Teams

Detection of phishing domains and domain squatting. Supports permutations such as homograph attack, typosquatting and bitsquatting.

OSINT, Threat Hunting, Network and Web Recon, Discovery, Enumeration, Vulnerability Mapping, Exploitation, Reporting

红蓝对抗跨平台远控工具

C# Implementation of Jared Atkinson's Get-InjectedThread.ps1

This repository contains a collection of PowerShell tools that can be utilized to protect and defend an environment based on the recommendations of multiple cyber security researchers at Microsoft. These tools were created with a small to medium size enterprise environment in mind as smaller organizations do not always have the type of funding available to overly spend on security. The goal of this project is to help add value to an smaller organizations security by creating more visibility for the average IT Administrator. Organizations with 1,000’s of devices may find that this entire suite does not apply to them.

Purple Team Exercise Framework

Invoke-HardeningKitty - Checks and hardens your Windows configuration

Bi-weekly hunting queries

These are some of the commands which I use frequently during Malware Analysis and DFIR.

Supporting material for my presentation "Adversarial Threat Modelling — A Practical Approach to Purple Teaming in the Enterprise"

Monitoring GitLab for sensitive data shared publicly

Monitoring GitHub for sensitive data shared publicly

Active Directory ACL Visualizer and Explorer - who's really Domain Admin?

A collection of scripts, tools. and configs for various OS'es and applications, all free and or open-source, to assist in impromptu Blue-Team defense under an active threat.

An open-source listing of cybersecurity technology mapped to the NIST Cybersecurity Framework (CSF)

Tools for playing w/ CobaltStrike config - extractin, detection, processing, etc...

WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.

Data leak checker & OSINT Tool

红蓝对抗以及护网相关工具和资料，内存shellcode（cs+msf）和内存马查杀工具

PacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter accepts a pcap as an argument and outputs several files.

One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️

JSON DataSet for macOS mapped to MITRE ATT&CK Tactics.

Detect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)

A tool for simplifying the process of researching IOCs.

Find and notify users in your Active Directory with weak passwords

Provides various Windows Server Active Directory (AD) security-focused reports.

You didn't think I'd go and leave the blue team out, right?

This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform.

BoobSnail allows generating Excel 4.0 XLM macro. Its purpose is to support the RedTeam and BlueTeam in XLM macro generation.

ETWNetMonv3 is simple C# code for Monitoring TCP Network Connection via ETW & ETWProcessMon/2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.

Web Application Secure Coding Handbook resource.

Emulate and Dissect MSF and *other* attacks

ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.

A list of vulnerabilities or design flaws that Microsoft does not intend to fix. Since the number is growing, I decided to make a list. This list covers only vulnerabilities that came up in July 2021 (and SpoolSample ;-))

Collecting IOCs posted on Twitter

Goblyn is a Python tool focused to enumeration and capture of website files metadata.

一款适用于红蓝对抗中的仿真钓鱼系统

Free copy of The Cyber Plumber's Handbook

A BeaconEye implement in Golang. It is used to detect the cobaltstrike beacon from memory and extract some configuration.

MAL-CL (Malicious Command-Line)

Graph Visualization for windows event logs

Blue Team detection lab created with Terraform and Ansible.

A Python Bytecode Disassembler helping reverse engineers in dissecting Python binaries by disassembling and analyzing the compiled python byte-code(.pyc) files across all python versions (including Python 3.10.*)

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

Scan your code for security misconfiguration, search for passwords and secrets. :mag:

Looks up details on a public IPV4 address against ip-info and blacklist-search sites. Providing a reputation check.

Searches online paste sites for certain search terms which can indicate a possible data breach.

The goal of this repository is to document the most common techniques to bypass AppLocker.