A collection of content for blue team professionals, designed to support both reactive and proactive cybersecurity measures of every aspect.

A starter pack of resources to help you get started in Detection Engineering.

AI Red Teaming playground labs to run AI Red Teaming trainings including infrastructure.

Tool for Active Directory Certificate Services enumeration and abuse

Maester is a PowerShell based test automation framework to help you stay in control of your Microsoft security configuration.

The Python Risk Identification Tool for generative AI (PyRIT) is an open source framework built to empower security professionals and engineers to proactively identify risks in generative AI systems.

PurpleCrew based on CrewAI with AI agents

Lightweight security tool for auditing your organization's Conditional Access Policies (CAPs) in Microsoft Entra ID for potential misconfigurations.

This tool parses Windows EVTX logs to extract login and logout sessions from a security.evtx file. It uses a Tkinter GUI to let you select the EVTX file and specify a time for correlating login and…

PurpleLab is an efficient and readily deployable lab solution, providing a swift setup for cybersecurity professionals to test detection rules, simulate logs, and undertake various security tasks,…

Simple hunting script for suspicious M365 OAuth Apps

AI-Powered, Local Pythonic Coding Agent 🐞💻

Semgrep Rules for Detecting Magecart Skimmers and Obfuscated JavaScript

An Infrastructure as code proof of concept to deploy a bare minimum AD environment in AWS.

PowerShell tools to help defenders hunt smarter, hunt harder.

Parses USB connection artifacts from offline Registry hives

A large collection of system log datasets for AI-driven log analytics [ISSRE'23]

This repository contains a comprehensive testing designed for evaluating the performance and resilience of Endpoint Detection and Response (EDR) systems

Save toil in security operations with: Detection & Intelligence Analysis for New Alerts (D.I.A.N.A. )

A tool that takes over Windows Updates to craft custom downgrades and expose past fixed vulnerabilities

Kernel mode WinDbg extension and PoCs for token privilege investigation.

A command-line productivity tool powered by AI large language models like GPT-4, will help you accomplish your tasks faster and more efficiently.

An ATT&CK Navigator layer displaying 50 of the most common TTPs seen during CTF challenges

ESXi security configuration audit.

A comprehensive list of all cyber security/ethical hacking/information security societies associated to universities within the UK.

The Jolly Executioner - a simple command execution proxy

smbclient-ng, a fast and user friendly way to interact with SMB shares.