Madhukar Raina

SysmonSimulator. Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams.

PopulateActiveDirectory. Powershell script to build active directory forest and populate AD with random AD objects including AD users objects, computers objects, groups objects, GPOs and network shares required. It also adds ASREProast account, kerberoastable account, and misconfigured ACLs to the domain for testing purposes

ActiveDirectoryInstallation. Active Directory Installation Script

RootDSE-ActiveDirectory. This repo contains files that i refer in my blogs

AD-Attack-Defense. Attack and defend active directory using modern post exploitation adversary tradecraft activity

DefenderNotify. NotifyIcon for Defender from WMI Event Watcher task

Detect-Evil-Machine. A C# tool that detects when a computer account is added to any of the created domain security groups.

Detect-DomainAdmin-Change. Description : A C# tool to detect a change to the domain admins group membership and notify this activity

ASM-NewDCAdmins. A C# tool to gather the administrators on the domain controller (including local accounts) and detects when it changes.

Detect-Spray. A C# tool that detects password spraying attempt by using Active Directory user attributes

ASM-NewRemoteAdmins. A C# tool to gather the count of administrators on the crown jewel machine and detects when this number changes

DC-Rename. It assists in renaming the Domain Controller correctly if something goes wrong while installation of test AD lab