Jonathan Johnson

MSRPC-to-ATTACK. A repository that maps commonly used attacks using MSRPC protocols to ATT&CK

JonMon. C++

TelemetrySource.

ETWInspector. C#

Marvel-Lab. A collection of Powershell scripts that will help automate the build process for a Marvel domain.

Windows-API-To-Sysmon-Events. A repository that maps API calls to Sysmon Event ID's.

PowerParse. PowerShell PE Parser

RandomPOCs. Repo that holds random POCs

JonMon-Lite. C++

LDAPMon. C++

MSFT_DriverBlockList. Repository of Microsoft Driver Block Lists based off of OS-builds

EtwWatcher. Browse and diff ETW provider snapshots across Windows builds. Backed by ETWInspector.

EventSight. AI-powered Windows Event Log analyzer that learns from your feedback. Uses Claude AI with RAG to detect suspicious activity, improve accuracy over time, and share learnings across your team. CLI and MCP server interfaces.

Detecting-Process-Injection-Techniques. This is a repository that is meant to hold detections for various process injection techniques.

ProcCallback. An example of how a driver can register a handle creation callback.

Automated-Detection-Pipeline. Jupyter Notebook

jonny-jhnson.

mordor. Re-play Adversarial Techniques

Import-Marvel. Powershell script and CSV file that allows you to import marvel characters into Active Directory

Presentations.

ApacheGuacamole. Install Script for ApacheGuacamole

VulnerableService. Powershell script to create a vulnerable service, that can be easily used for privilege escalation

WinDbg-Scripts. Repository that holds WinDbg scripts that I have created to help with various tasks.

Python-Socket-Chat-room. Created a chat room in socket python

Python-Port-Scanner. Python

Import-LOTR. Powershell script and CSV file that allows you to import characters from Lord of the Rings as Users, into Active Directory

IPC-Mechanisms.

WonkaVision. C#

PSReflect-Functions. Module to provide PowerShell functions that abstract Win32 API functions