#CVE-2022

An eBPF detection program for CVE-2022-0847

https://github.com/airbus-cert/dirtypipe-ebpf_detection

@BlueRedTeam

#Cobalt_Strike

Public variation of Titan Loader. Tweaks Cobalt Strike's behavior with Import Address Table Hooks

https://github.com/SecIdiot/TitanLdr

@BlueRedTeam

#Red_Team

​Red-Teaming-TTPs

Free Resources to Practice

https://github.com/RoseSecurity/Red-Teaming-TTPs

@BlueRedTeam

#Red_Team

Red Teaming & Active Directory Cheat Sheet

https://github.com/expl0itabl3/Redsheet

@BlueRedTeam

#Red_Team

Red Team Stuffs

https://github.com/6vr/Red-Team-Tips

@BlueRedTeam

#getshell

S2-061 getshell

https://github.com/nevermo0re/S2-061

@BlueRedTeam

#Cobalt_Strike

Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.

https://github.com/netero1010/RDPHijack-BOF

@BlueRedTeam

#Red_Team
Scripts to set up Red Team practice labs.

https://github.com/idchoppers/rtsetup

@BlueRedTeam

#Red_Team
Red Team Project Repo

https://github.com/Jarney903/Red-ProjectHub

@BlueRedTeam

#Cobalt_Strike

Cobalt Strike BOF Files with Nim!

https://github.com/byt3bl33d3r/BOF-Nim

@BlueRedTeam

#Cobalt_Strike

RDLL for Cobalt Strike beacon to silence sysmon process

https://github.com/ScriptIdiot/SysmonQuiet

@BlueRedTeam

#Cobalt_Strike

Miscellaneous Cobalt Strike Beacon Object Files

https://github.com/stufus/bofs

@BlueRedTeam

#Red_Team

A framework for visualizing data source coverage, Atomic Red Team test results, and adversary techniques coverage

https://github.com/ColeStrickler/Vizual1zer

@BlueRedTeam

#Cobalt_Strike
​BeaconNotifier-Discord

Cobalt strike CNA noscript to notify you via Discord whenever there is a new beacon.

https://github.com/ScriptIdiot/BeaconNotifier-Discord

@BlueRedTeam

PoshC2

A proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.

PoshC2 is primarily written in Python3 and follows a modular format to enable users to add their own modules and tools, allowing an extendible and flexible C2 framework.

Out-of-the-box PoshC2 comes PowerShell/C# and Python2/Python3 implants with payloads written in PowerShell v2 and v4, C++ and C# source code, a variety of executables, DLLs and raw shellcode in addition to a Python2/Python3 payload. These enable C2 functionality on a wide range of devices and operating systems, including Windows, *nix and OSX.

https://github.com/nettitude/PoshC2

Documentation:
https://poshc2.readthedocs.io/en/latest/

@BlueRedTeam

#tools
#Blue_Team

Windows Registry Forensic Analysis using Chainsaw, Wazuh Agent and Sigma Rules
https://socfortress.medium.com/windows-registry-forensic-analysis-using-chainsaw-wazuh-agent-and-sigma-rules-40dbceba7201
+ Exploiting Authentication in AWS IAM Authenticator for Kubernetes
https://blog.lightspin.io/exploiting-eks-authentication-vulnerability-in-aws-iam-authenticator

@BlueRedTeam

#Red_Team

Abusing forgotten permissions on computer objects in Active Directory
https://dirkjanm.io/abusing-forgotten-permissions-on-precreated-computer-objects-in-active-directory

@BlueRedTeam

#Red_Team

Assessment, Analysis, and Hardening of a vulnerable system. This report includes a Red Team Security Assessment, a Blue Team Log Analysis, and Hardening and Mitigation Strategies.

https://github.com/Maximus-Meridius-SC/Project-2-Red-Team-vs.-Blue-Team

@BlueRedTeam

#Blue_Team

Tips to construct a web application firewall

https://antonio-cooler.gitbook.io/coolervoid-tavern

@BlueRedTeam

#tools
#Red_Team

+ Tool to start processes as SYSTEM using token duplication

https://github.com/magnusstubman/tokenduplicator
+ Splunk Attack Range 2.0

https://www.splunk.com/en_us/blog/security/introducing-splunk-attack-range-v2-0.html

https://github.com/splunk/attack_range

@BlueRedTeam

#Red_Team

​​Abusing forgotten permissions on computer objects in Active Directory

https://dirkjanm.io/abusing-forgotten-permissions-on-precreated-computer-objects-in-active-directory

@BlueRedTeam