olafhartong Goto Github PK

followers: 982.0 following: 4.0 repos: 68.0 gists: 24.0

Name: Olaf Hartong

Type: User

Company: @FalconForceTeam

Twitter: olafhartong

Location: The Netherlands

Blog: http://olafhartong.nl

Hi there 👋

I'm a defensive specialist and security researcher at FalconForce and specialize in understanding the attacker tradecraft and thereby improving detection.

I'm a Microsoft MVP and have presented at many industry conferences including Black Hat, DEF CON, DerbyCon, Splunk .conf, FIRST, MITRE ATT&CKcon, and various other conferences.

I maintain a blog at olafhartong.nl.

You can also find me on Twitter and LinkedIn.

Olaf Hartong's Projects

applehealthdata-es

Config to import applehealth data to ElasticSearch, generate with > https://github.com/tdda/applehealthdata

arthir

ATT&CK Remote Threat Hunting Incident Response

attack_range

A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

attackdatamap

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

azure-rest-api-specs

The source for REST API specifications for Microsoft Azure.

azure-sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

badges

ToolsWatch and Black Hat Arsenal selection of badges

bhceupload

A small go tool to upload JSON files to the BloodHound community edition API

blackhat-arsenal-tools

Official Black Hat Arsenal Security Tools Repository

bloodhound

Six Degrees of Domain Admin

brawl-public-game-001

Data from a BRAWL Automated Adversary Emulation Exercise

chargeback

Charge Back App for Splunk

clear-dminline

After migrating a Cisco ASA config to a Palo Alto config you remain with all these horrible DMINLINE objects, this tool resolves all members and replaces the ogroup object by its members

cti

Cyber Threat Intelligence Repository expressed in STIX 2.0

defenderharvester

Expose a lot of MDE telemetry that is not easily accessible in any searchable form

detection-sources

detectionlab

Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices

disposable-windows

A packer project to quickly have a test / dev / IR box

eqgrp_lost_in_translation

Decrypted content of odd.tar.xz.gpg, swift.tar.xz.gpg and windows.tar.xz.gpg

event-forwarding-guidance

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. iadgov

flushwifi

a simple script written for OSX to restart all network interfaces, clear ARP cache, and flush routes. also includes MAC randomization and protection from ICMP redirect attacks.