Sample queries for Advanced hunting in Microsoft 365 Defender

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

A remote control and remote scripting solution, built with .NET 8, Blazor, and SignalR.

Uses Harmony to intercept methods used by WebClient, xNet, etc. and log URLs

Ressources

Minimal bash script and compose file to deploy standalone Splunk instance with the BoTSv3 dataset + required apps

DarkAgent Remote Administration Tool RAT by DragonHunter

C# RAT (Remote Administration Tool)

Covenant is a collaborative .NET C2 framework for red teamers.

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.

Adversary Emulation Framework

Xst Reader is an open source viewer for Microsoft Outlook’s .ost and .pst files, written entirely in C#. To download an executable of the current version, go to the releases tab.

CyLR - Live Response Collection Tool

Powershell Based tool for gathering information related to O365 intrusions and potential Breaches

A tool to kill antimalware protected processes

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.

mpeepdf is a modified version of a powerful Python tool - peepdf to analyze PDF documents

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. [email protected]

YARA Rules I come across on the internet

Stable Diffusion web UI

Stable Diffusion web UI

Easiest 1-click way to create beautiful artwork on your PC using AI, with no tech knowledge. Provides a browser UI for generating images from text prompts and images. Just enter your text prompt, a…

$MFT parser (from live systems or a copy of the $MFT) and raw file copy utility

Documentation repository

Open XML SDK by Microsoft

PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

C# Reflective loader for unmanaged binaries.