ateeshrajak / hunting-scripts

A collection of hunting and blue team scripts. Mostly others, some my own.

Hunting-Scripts

A collection of hunting, blue team scripts and tools ; mostly others.

PowerShell--

fake sandbox https://github.com/Phoenix1747/fake-sandbox

DevSec to detect PS TickUsage & Obfuscation, https://github.com/danielbohannon/DevSec-Defense https://www.x33fcon.com/archive/2018/slides/x33fcon18_DevSecDefense_DanielBohannon.pdf https://www.youtube.com/watch?v=QJe8xikf-iE

Process Spawn Control suspends newly launched processes https://github.com/felixweyne/ProcessSpawnControl

Find injected processes https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2

Find Forms https://gist.github.com/staaldraad/0604788fbe974cd53ed59cc1e3185cce

Detect rule attacks in windows events https://gist.github.com/staaldraad/a7de22afa69ec10f1ec7d995d2bd913c

Timeline from memeory https://www.pigstye.net/forensics/volatility.html

Invoke-Adversary to test defenses https://github.com/MotiBa/Invoke-Adversary/tree/master

Baseline gold PEs https://posts.specterops.io/what-is-it-that-makes-a-microsoft-executable-a-microsoft-executable-b43ac612195e

Remove macros https://chentiangemalc.wordpress.com/2012/01/17/powershell-script-to-remove-office-macro-protection/

PS to pcap https://www.nospaceships.com/2018/09/19/packet-capture-on-windows-without-drivers.html

Find Kerberos Golden Tickets https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285 & https://github.com/spohara79/TGT---Golden-Silver-Ticket

Skeleton Key scanner https://gallery.technet.microsoft.com/Aorato-Skeleton-Key-24e46b73

Detect ruler attacks in Exchange and DC logs https://sensepost.com/blog/2017/notruler-turning-offence-into-defence/

Detect DCShadow attacks https://github.com/AlsidOfficial/UncoverDCShadow

A PowerShell script to interact with the MITRE ATT&CK Framework via its own API https://github.com/Cyb3rWard0g/Invoke-ATTACKAPI

Mitigate internal recon by altering Net Session Enumeration https://gallery.technet.microsoft.com/Net-Cease-Blocking-Net-1e8dcb5b

Hunting webshells on Microsoft Exchange Servers https://github.com/FixTheExchange/Invoke-ExchangeWebShellHunter

Power Forensics https://github.com/Invoke-IR/PowerForensics

Mem pull https://github.com/n3l5/irMempull

PS IR https://github.com/mgreen27/Powershell-IR https://www.linkedin.com/pulse/invoke-liveresponse-matthew-green

DeepBlue CLI https://github.com/sans-blue-team/DeepBlueCLI

Jason Fossen's https://github.com/EnclaveConsulting/SANS-SEC505

PS script to detects memory-only CLR (.NET) modules https://gist.github.com/dezhub/2875fa6dc78083cedeab10abc551cb58

Flare http://boxstarter.org/package/url?https://raw.githubusercontent.com/fireeye/flare-vm/master/flarevm_malware.ps1 https://github.com/fireeye/flare-vm

RVMI Rekall https://github.com/fireeye/rvmi-rekall

List Kerberos Tickets https://gallery.technet.microsoft.com/scriptcenter/List-All-Cached-Kerberos-5ba41829

List local admins https://gallery.technet.microsoft.com/scriptcenter/ed4a0cb7-603c-488d-afeb-194b7a60f42f

Get AD Trust Topology https://gallery.technet.microsoft.com/scriptcenter/ADFS-Security-Audit-Events-81c207cf & https://github.com/WiredPulse/PowerShell/blob/master/Active_Directory/Get-DomainTrusts.ps1

ADFS Security Audit Events Parser https://gallery.technet.microsoft.com/scriptcenter/ADFS-Security-Audit-Events-81c207cf

Self Signign Certs https://gallery.technet.microsoft.com/scriptcenter/Get-AD-Trust-Topology-f8f2d1d7 & http://cyberfibers.com/2017/11/hunting-self-signed-certificates/

Encrypt/Decrypt files using AES encryption https://gallery.technet.microsoft.com/scriptcenter/EncryptDecrypt-files-use-65e7ae5d

Get the status of A/V local or remote https://gallery.technet.microsoft.com/scriptcenter/Get-the-status-of-4b748f25

List SPNs https://gallery.technet.microsoft.com/List-all-SPNs-Used-in-your-e0c6267a

Invoke web request detection https://gist.github.com/Centurion89/33b9517b75d238b59fd85fd060514279

Another PS list https://www.peerlyst.com/posts/resource-infosec-powershell-tools-resources-and-authors

Managing PowerShell in a modern corporate environment https://www.nccgroup.trust/uk/our-research/managing-powershell-in-a-modern-corporate-environment/

Detect PS obfuscation https://github.com/jaapbrasser/Events/blob/master/2017-09-01_BSidesAms2017/Demo/Demo2.ps1 vid https://www.youtube.com/watch?v=WOC8vC2KoNs&list=PLwZycuzv10iLBFwRIWNAR-s4iuuUMRuEB&index=12

PoSH IR and PS https://github.com/WiredPulse/PoSh-R2

PS hash compare, find bad CCleaner example, net conns http://cyberfibers.com/category/powershell/

EternalBlue vul scan https://gallery.technet.microsoft.com/scriptcenter/EternalBlue-Vulnerability-bf3ad11d

Generate Applocker rule based on hash https://gallery.technet.microsoft.com/scriptcenter/Generate-AppLocker-baaa9278

Check Autoruns at bootup https://gallery.technet.microsoft.com/scriptcenter/Malware-detection-and-995f01eb

CERT diff https://isc.sans.edu/forums/diary/Keep+An+Eye+on+your+Root+Certificates/23030/

fake sandbox https://github.com/Phoenix1747/fake-sandbox

Various PS https://github.com/WiredPulse/PowerShell

Hunt PS scripts https://github.com/DLACERT/ThreatHunting

Detect PTH https://github.com/cyberark/ketshash

Detect shadow admins https://github.com/cyberark/ACLight

Find Exchange Mailboxes with Forwarding Addresses Enabled http://www.syspanda.com/index.php/2018/01/10/exchange-find-mailboxes-forwarding-addresses-enabled/

Get USB history https://gallery.technet.microsoft.com/scriptcenter/Get-USBHistory-707e43a3

ms17-010-Scanner https://github.com/vletoux/ms17-010-Scanner

Find local priv escalation https://github.com/rasta-mouse/Sherlock/blob/master/Sherlock.ps1

Threat Hunting Reconnaissance Toolkit THRecon https://github.com/TonyPhipps/THRecon

PoweSehll Defense https://github.com/Ben0xA/PowerShellDefense

Extracts Windows Defender Exploit Guard Events from the 'Microsoft-Windows-Windows Defender/Operational event log https://demo.wd.microsoft.com/Content/getEGEvents.zip

Audit script https://github.com/A-mIn3/WINspect

User Simulator https://github.com/ubeeri/Invoke-UserSimulator

Audit AD https://github.com/phillips321/adaudit

Evil Maid detection https://pastebin.com/hAEHibHf

SQli detection https://github.com/NetSPI/PowerUpSQL

Check the carved memory file for presence of Meterpreter C2 https://github.com/countercept/memory-carving-scripts/blob/master/Get-MeterpreterC2.ps1

Dump memory http://www.exploit-monday.com/2012/03/powershell-live-memory-analysis-tools.html#Dump-Memory

Find vul GPOs https://github.com/gpoguy/GetVulnerableGPO

OAuth Hunting (Azure) https://github.com/dmb2168/OAuthHunting

Test phish defenses by w/macros https://github.com/curi0usJack/luckystrike

Discover Unquoted Service Paths that can be abused to escalate privs https://gist.github.com/Evilcry/ba70b8fa746ef7ae352d14bcaaf6bfbb

Yara--

Outlook ruler detetion https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html

Signaturing an Authenticode anomaly with Yara https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/september/signaturing-an-authenticode-anomaly-with-yara/

Loki https://github.com/Neo23x0/Loki

Entropy of PE files https://cyberdefenses.com/yara-entropy-bit-math/

Rule for CCleaner https://blog.nviso.be/2017/09/21/yara-rules-for-ccleaner-5-33/

Detect MimiK golden ticket https://blog.didierstevens.com/2016/08/12/mimikatz-golden-ticket-dcsync/

HEX to assembly https://haiderm.com/convert-hex-assembly-using-simple-python-script/

Bin/API analysis including FN2Yara https://github.com/cmu-sei/pharos

Find fake certs https://blog.nviso.be/2018/07/31/powershell-inside-a-certificate-part-1/

Python--

find malicous .net malware compile https://gist.github.com/countercept/7765ba05ad00255bcf6a4a26d7647f6e

find doublepulsar https://github.com/countercept/doublepulsar-detection-script

Script to check for security bugs in smart contracts https://github.com/ConsenSys/mythril/blob/master/security_checks.md

Ransoeare simulator https://gitlab.com/networkintelligence/inr/ransom_sim/tree/master

Script for malware analysis https://github.com/beenuar/Py-DarkC0de/blob/master/analyse_malware.py

Make your own Volatility plug-in https://github.com/iAbadia/Volatility-Plugin-Tutorial

Kill Chain Fuzzer https://github.com/SafeBreach-Labs/blog-snippets/blob/master/killchainfuzzer.py

FastIR https://github.com/SekoiaLab/Fastir_Collector

Mystique - enterprise malicoius mutex detection https://github.com/MinervaLabsResearch/Mystique

SSDeep Elastic https://github.com/intezer/ssdeep-elastic

Memory Patch detector https://github.com/intezer/MemoryPatchDetector

Script to compare your similar Linux cloud application servers with each other to discover possible indications of compromise. https://github.com/morphuslabs/distinct

Phishing catcher using Certstream (https://certstream.calidog.io/) https://github.com/x0rz/phishing_catcher

Leak File Analyzer https://github.com/Neo23x0/radiocarbon

Find miners https://github.com/wrinkl3/MineSweepR

Inspect PDFs https://github.com/jesparza/peepdf

User simulation https://github.com/cmu-sei/usersim

Find Peddelcheap in pcaps https://github.com/johnbergbom/PeddleCheap/blob/master/dp_decrypt.py (with samples)

Find danderspritz https://github.com/fox-it/danderspritz-evtx

Python exe unpacker https://github.com/countercept/python-exe-unpacker

RDP Bitmap Cache parser https://github.com/ANSSI-FR/bmc-tools

Mac OS IR Tool https://github.com/daguy666/Transit

Tool for automatic list generation of known TOR and VPN exit nodes https://github.com/uforia/exitgather

parsing tool to discover potential SQL injection points https://github.com/RhinoSecurityLabs/SleuthQL

Go

find websells (can use regular expressions) https://github.com/tstillz/webshell-scan

Misc--

Open source tools Netflix Security Team https://medium.com/netflix-techblog/a-brief-history-of-open-source-from-the-netflix-cloud-security-team-412b5d4f1e0c

APT Simulator https://github.com/Neo23x0/APTSimulator

Inection Monkey - APT Simulator https://github.com/guardicore/monkey

CALDERA automated adversary emulation system https://github.com/mitre/caldera

APT3 Emulator https://attack.mitre.org/wiki/Adversary_Emulation_Plans

PS to exe https://github.com/interference-security/PS2EXE

YARA signature to check for DEP and ASLR https://summitroute.com/blog/2017/07/24/yara_sigs_for_security_best_practices/

CyLR CDQR Forensics Virtual Machine (CCF-VM) https://github.com/rough007/CCF-VM (a-z - endpoint IR collection to dbase backend)

Threat Hunting Playbook https://github.com/Kathayra/ThreatHunter-Playbook TH tracking https://github.com/Kathayra/HT-Trackr

Android Vul tester https://github.com/AndroidVTS/android-vts

Sysmon config https://github.com/SwiftOnSecurity/sysmon-config

GRR write up https://chip-dfir.techanarchy.net/?p=395

Detect dll hijacking https://github.com/adamkramer/dll_hijack_detect

Detection mapped to Mitre Matrix https://github.com/redcanaryco/atomic-red-team

.NET runtine inspector https://github.com/enkomio/shed

harden windows https://github.com/securitywithoutborders/hardentools/releases/tag/v1.0

Deception -- It is all about the buzz

Emulate VM enviroments https://github.com/adamkramer/rapid_env

test a sandox - PoC malware with good intentions https://github.com/LordNoteworthy/al-khaser

Pafish - Testing tool to emulate an infection https://github.com/a0rtega/pafish

https://canarytokens.org/generate

todo: FTK scripting https://accessdata.com/product-download/windows-32bit-3.1.1/

Hook Finder https://github.com/hasherezade/hook_finder

Lateral Movement script https://securelist.com/happy-ir-in-the-new-year/83557/

find dll injects http://cyberfibers.com/2017/11/525/

event subscription https://github.com/palantir/windows-event-forwarding

Binary commandline executable to parse ETL files https://github.com/gcpartners/ETLParser

other lists --

https://github.com/rshipp/awesome-malware-analysis

https://github.com/0x4D31/awesome-threat-detection