Kostas

EDR-Telemetry. This project aims to compare and evaluate the telemetry of various EDR products.

TeleTracker. TeleTracker is a simple set of Python scripts designed for anyone investigating Telegram channels. It helps you send messages quickly and gather useful channel information easily.

awesome-dfir-skills. A curated collection of DFIR skills and workflows for InfoSec practitioners.

translated_conti_leaked_comms. Leaked communication of Conti ransomware group from Jan 29, 2021 to Feb 27, 2022

Sigma_rules. Sigma rules to share with the community

EDR-Telemetry-Website. JavaScript

BlueSploit. BlueSploit is a DFIR framework with the main purpose being to quickly capture artifacts for later review.

Intrusion_data. This repository is created to store the artifacts for any intrusions I share publicly.

Threat-Intelligence-Playbooks. High-level Threat Intelligence playbooks

TA_tooling.

Rita-zeek_analysis. Script to install rita and zeek and then analyze related logs

ThreatStream-API-Intelligence-calls. This script allows you to query any intelligence from your ThreatStream TIP using their RESTful API.

Kostas_Yara-Rules. IR yara rules

Active-Directory-Exploitation-Cheat-Sheet. A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

awesome-incident-response. A curated list of tools for incident response

MITRE_ATT-CK-navigator-JSON-to-HTML. HTML

AWS_instances_automation. Python

sigma. Generic Signature Format for SIEM Systems

atomic-red-team. Small and highly portable detection tests based on MITRE's ATT&CK.

templates. Document templates for open-source projects (README, CONTRIBUTING, GitHub templates)

PyIntelOwl-Parser. This is a "plugin" colourful parser for PyIntelOwl. It takes the JSON results and parsing them in a colourful, easy to read way.

SSH-task-automation. Python

pyintelowl. Simple Client for Intel Owl