Hunt down social media accounts by username across social networks

Fast, multi-modal context for agents

LotL RMM

Automate Docker container image updates

Certificate Transparency log monitor

A Certificate Transparency log implementation and monitoring API designed for scalability, ease of operation, and reduced cost.

Research into Undocumented Behavior of Azure AD Refresh Tokens

Windows Secure Shell Client With Support For Smart Cards, Certificates, & FIDO Keys

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

Proofs of concept which successfully authenticate with MikroTik Winbox and MAC Telnet servers running on RouterOS version 6.45.1+

MDE Tester is designed to help testing various features in Microsoft Defender for Endpoint.

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

A flexible, modern and blazingly fast ☄️ status page

Sagan is a multi-threads, high performance log analysis engine. At it's core, Sagan similar to Suricata/Snort but with logs rather than network packets.

Volatility 3.0 development

The multi-platform memory acquisition tool.

SightingDB is a database for Sightings

speeve spews EVE

Fermion, an electron wrapper for Frida & Monaco.

HardeningKitty and Windows Hardening Settings

Cmd.exe Command Obfuscation Generator & Detection Test Harness

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

A framework for developing alerting and detection strategies for incident response.

A PowerShell Module Dedicated to Reverse Engineering

Re-play Security Events

Windows Events Attack Samples

Malware Configuration And Payload Extraction

Detect Tactics, Techniques & Combat Threats