LOLBAS - Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

•    XSLT

---

There are currently three different lists. The goal of these lists are to document every binary, script and library that can be used for Living Off The Land techniques.

lolbins lolscripts redteam blueteam purpleteam dfir living-off-the-land

PlumHound - Bloodhound for Blue and Purple Teams

•    Python

---

Released as Proof of Concept for Blue and Purple teams to more effectively use BloodHoundAD in continual security life-cycles by utilizing the BloodHoundAD pathfinding engine to identify Active Directory security vulnerabilities resulting from business operations, procedures, policies and legacy service operations. PlumHound operates by wrapping BloodHoundAD's powerhouse graphical Neo4J backend cypher queries into operations-consumable reports. Analyzing the output of PlumHound can steer security teams in identifying and hardening common Active Directory configuration vulnerabilities and oversights.

neo4j directory active-directory bloodhound active infosec blueteam purpleteam bloodhoundad bloodhoundad-cypher-queries purple-teams plumhound-tasks bloodhoundad-pathfinding-engine bluehound attack-paths

APT-Hunter - APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

•    Python

---

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity . this tool will make a good use of the windows event logs collected and make sure to not miss critical events configured to be detected. If you are a Threat Hunter , Incident Responder or forensic investigator , i assure you will enjoy using this tool , why ? i will discuss the reason in this article and how it will make your life easy just it made mine . Kindly note this tool is heavily tested but still a beta version and may contain bugs . The first thing to do is to collect the logs if you didn’t and with powershell log collectors its easy to collect the needed logs automatically you just run the powershell scripts as administrator .

incident-response python3 threat-hunting windows-eventlog forensic-analysis purpleteam windows-event-logs apt-attacks