#Red_Team

+ Spoofing Calendar Invites Using .ics Files
https://mrd0x.com/spoofing-calendar-invites-using-ics-files
+ Opera Browser VPN Bypass
https://medium.com/@renwa/opera-browser-vpn-bypass-20877aaf08c0

@BlueRedTeam

#Blue_Team
+ PowerShell noscript to collect a packet trace with option to convert .etl to .pcap
https://github.com/dwmetz/QuickPcap
+ Zeroday MS Exchange Server checker
(Virtual Patching checker)
https://github.com/VNCERT-CC/0dayex-checker
+ Exchange On-premises Mitigation Tool v2 (EOMTv2)
https://microsoft.github.io/CSS-Exchange/Security/EOMTv2

@BlueRedTeam

multi-command mimikatz functionality in a CS beacon

https://gist.github.com/tothi/2809d548f7407de781892c4f840fdee1

@BlueRedTeam

#Red_Team
+ Certifried combined with KrbRelayUp
https://gist.github.com/tothi/f89a37127f2233352d74eef6c748ca25
+ Using NTLMRawUnHide to Uncover NTLMv2 Hashes
https://www.mike-gualtieri.com/posts/live-off-the-land-and-crack-the-ntlmssp-protocol

@BlueRedTeam

#Blue_Team
1. LMD - Linux Malware Detection
https://github.com/rfxn/linux-malware-detect
2. Aftermath - free macOS IR framework
https://github.com/jamf/aftermath

@BlueRedTeam

#Blue_Team

Advanced Sysmon ATT&CK configuration

https://github.com/ion-storm/sysmon-config

@BlueRedTeam

#webshell

Yara rule for web threat (webshell, redirector)

https://github.com/farhanfaisal/yararule_web

@BlueRedTeam

#Red_Team

Detects the feasibility of sending emails, which can be used to test target email accounts in red team operations. The feasibility sent by the detection mail can be used for the target mailbox account test in the Red Team battle.

https://github.com/808Mak1r/CEmail

@BlueRedTeam

#Red_Team
Red Team Toolkit for CTF's and Learning for Windows Offense

https://github.com/JHKLing/Red-VS-Blue-Project

@BlueRedTeam

#Red_Team

ShadowSpray - tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects
https://github.com/Dec0ne/ShadowSpray
@BlueRedTeam

#Red_Team

+ Living-Off-the-Blindspot - Operating into EDRs’ blindspot
https://www.naksyn.com/edr%20evasion/2022/09/01/operating-into-EDRs-blindspot.html
+ On Bypassing eBPF Security Monitoring
https://blog.doyensec.com/2022/10/11/ebpf-bypass-security-monitoring.html

@BlueRedTeam

#Red_Team
1. Pivoting Over TTLS-PAP WPA Enterprise Networks
https://tbhaxor.com/pivoting-over-ttls-pap-wifi-network
2. Active Directory data collector for BloodHound
https://github.com/OPENCYBER-FR/RustHound

@BlueRedTeam

#Cobalt_Strike

An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot saved to disk as a file.

https://github.com/CodeXTF2/ScreenshotBOF

@BlueRedTeam

#Red_Team
Environment configuration for Red Team Cyber Security testings and tasks

https://github.com/zackjmccann/red-team-security

@BlueRedTeam

#Red_Team

Blog about personnal research, Red Team/AD/Maldev & CTF Writeups

https://github.com/0xSV1/NorwegianPasswordSpraying

@BlueRedTeam

#CVE-2022

Utilities for exploiting vulnerability CVE-2022-40684 (FortiOS / FortiProxy / FortiSwitchManager - Authentication bypass on administrative interface).

https://github.com/und3sc0n0c1d0/CVE-2022-40684

@BlueRedTeam

#CVE-2022

You can find a python noscript to exploit the vulnerability on Bitbucket related CVE-2022-36804.

https://github.com/khal4n1/CVE-2022-36804

@BlueRedTeam

#Blue_Team

How to Investigate Insider Threats (Forensic Methodology)

https://www.inversecos.com/2022/10/how-to-investigate-insider-threats.html

@BlueRedTeam

#Red_Team

+ Redeye - Pentest operation tool
https://github.com/redeye-framework/Redeye

+ Bayanay - Python Wardriving
https://github.com/anil-yelken/wardriving

@BlueRedTeam

#Red_Team

RedEye is an open-source analytic tool developed by CISA and DOE’s Pacific Northwest National Laboratory to assist Red Teams with visualizing and reporting command and control activities. This tool, released in October 2022 on GitHub, allows an operator to assess and display complex data, evaluate mitigation strategies, and enable effective decision making in response to a Red Team assessment.

The tool parses logs, such as those from Cobalt Strike, and presents the data in an easily digestible format. The users can then tag and add comments to activities displayed within the tool. The operators can use the RedEye’s presentation mode to present findings and workflow to stakeholders.

https://github.com/cisagov/RedEye

@BlueRedTeam