Adversary Emulation
9 projects
A Windows Batch script toolset that simulates Advanced Persistent Threat (APT) attack indicators to test security monitoring and detection capabilities.
A library of portable detection tests mapped to the MITRE ATT&CK framework for security testing.
A framework for automating offensive security testing by scripting security tool APIs like Empire and Metasploit.
An automated cyber security platform for adversary emulation, red teaming, and incident response built on the MITRE ATT&CK framework.
A modular, menu-driven tool for building time-delayed, distributed security event chains for Red, Blue, and Purple Team exercises.
An information security preparedness tool for adversarial simulation using Redis/Celery, Python, and Vagrant.
A lightweight utility to generate malicious network traffic patterns for evaluating security controls and network visibility.
A framework of Python scripts for blue teams to test detection capabilities against malicious tradecraft modeled after MITRE ATT&CK.
A pre-configured Linux virtual machine for adversary emulation and threat hunting with attacker and defender toolkits.
All-In-One Tools
25 projects
A PowerShell suite for remote Windows incident response and hunting using CIM/WMI, requiring no agent deployment.
A unified console for digital forensics and incident response (DFIR) built on the Viper Framework.
A digital forensics and incident response framework for unified analysis of forensic artifacts across disk formats, filesystems, and operating systems.
An osquery fleet manager for remote configuration, distributed queries, and alerting across devices.
A collection of software installation scripts for Windows that automates the setup and maintenance of a reverse engineering environment on a virtual machine.
Open-source platform for IT and security teams to manage and secure thousands of computers across diverse environments.
An incident response framework for remote live forensics with Python client-server architecture.
A web-based collaborative platform for incident responders to share technical details during cybersecurity investigations.
A digital forensics investigation platform for parsing, searching, visualizing evidence, and enabling team collaboration.
An open source, serverless security data lake for AWS that normalizes logs, enables detection-as-code, and supports petabyte-scale threat hunting.
An open-source security incident response platform that automates and coordinates enterprise defense workflows.
A CLI program for automating the deployment, configuration, and monitoring of cybersecurity solutions across multiple hosts.
An asynchronous forensic data presentation framework for incident response, built on Elasticsearch.
A browser extension that streamlines security investigations by providing quick lookups for IPs, domains, hashes, and other indicators.
An endpoint visibility and collection tool using the Velociraptor Query Language (VQL) for host-based state information gathering.
An open-source platform for unified management, security, and compliance of Apple device fleets in enterprise environments.
