Recon Hunt Queries

Automated Adversary Emulation Platform

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

A knowledge base of actionable Incident Response techniques

A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.

Use ExpiredDomains.net and BlueCoat to find useful domains for red team.

The GitHub of Adversary Emulation Plans in JSON. Share SCYTHE threats with the community. #ThreatThursday adversary emulation plans are shared here.

Intel Owl: analyze files, domains, IPs in multiple ways from a single API at scale

Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads

Fast and efficient osquery management

Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

Adversarial Robustness Toolbox (ART) - Python Library for Machine Learning Security - Evasion, Poisoning, Extraction, Inference - Red and Blue Teams

Python API Client for TheHive

PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform

PCAP Samples for Different Post Exploitation Techniques

A PowerShell-based toolkit and framework consisting of a collection of techniques and tradecraft for use in red team, post-exploitation, adversary simulation, or other offensive security tasks.