UltimateAppLockerByPassList
GoodHound
| UltimateAppLockerByPassList | GoodHound | |
|---|---|---|
| 4 | 2 | |
| 1,821 | 438 | |
| - | - | |
| 2.1 | 0.0 | |
| 9 months ago | about 2 years ago | |
| PowerShell | Python | |
| - | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
UltimateAppLockerByPassList
-
AppLocker - Deny vs Allow and Except
Check out the Ultimate AppLocker Bypass list and add those https://github.com/api0cradle/UltimateAppLockerByPassList
-
FSRM saved our asses
Too bad it's trivial to bypass. My favorite bypass is through alternate data streams, which Applocker is unaware of.
-
What group policy rule should ever network have?
Remember to block these writable paths in under c:\Windows: https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/Generic-AppLockerbypasses.md
- Safe powershell
GoodHound
-
Dealing with large BloodHound datasets
Name Description Url BloodHound BloodHound GUI https://github.com/BloodHoundAD/BloodHound/ PlumHound Generate a report with actions to resolve the security flaws in the Active Directory configuration https://github.com/DefensiveOrigins/PlumHound/ GoodHound GoodHound operationalises Bloodhound by determining the busiest paths to high value targets and creating actionable output to prioritise remediation of attack paths. https://github.com/idnahacks/GoodHound/ BlueHound Tool that helps blue teams pinpoint the security issues that actually matter. By combining information about user permissions, network access and unpatched vulnerabilities, BlueHound reveals the paths attackers would take if they were inside your network. https://github.com/zeronetworks/BlueHound/
- GoodHound - Using Bloodhound as a defender - prioritise which attack paths to fix first.
What are some alternatives?
HardeningKitty - HardeningKitty - Checks and hardens your Windows configuration
Keylogger - Get Keyboard,Mouse,ScreenShot,Microphone Inputs from Target Computer and Send to your Mail.
AaronLocker - Robust and practical application control for Windows
APT-Hunter - APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
LOLBAS - Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
ansible-ad-inventory - Ansible Active Directory Inventory script
CryptoBlocker - A script to deploy File Server Resource Manager and associated scripts to block infected users
PWF - Practical Windows Forensics Training
SlackPirate - Slack Enumeration and Extraction Tool - extract sensitive information from a Slack Workspace
cobalt-arsenal - My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+
chophound - Some scripts to support with importing large datasets into BloodHound