Cybersecurity Blue Team
Groups of individuals who identify security flaws in information technology systems.
Contents
Automation and Convention
Plugable framework for automated decryption, often used as a Tang client.
Extensible network forensic analysis framework written in Python that enables rapid development of plugins to support the dissection of network packet captures.
Collaborative, crowd-sourced data and code to make password management better.
Code libraries and bindings
File analysis framework written in Python that assists in evaluating a set of files by automatically running a suite of tools against them and aggregating the output.
PowerShell interface to VirusTotal.com APIs.
Python wrapper to the Censys REST API.
High level C++ network packet sniffing and crafting library.
Pythonic interface to the Internet Storm Center/DShield API.
Minimal, consistent Python API for building integrations with malware sandboxes.
Python APIs for serializing and de-serializing Structured Threat Information eXpression (STIX) JSON content, plus higher-level APIs for common tasks.
Cloud platform security
Helps in visualizing AWS IAM and Organizations in a graph format with help of Neo4j.
Quickly evaluate IAM permissions in AWS via script and library capable of identifying risks in the configuration of AWS Identity and Access Management (IAM) for an AWS account or an AWS organization.
Tool based on AWS-CLI commands for Amazon Web Services account security assessment and hardening.
Open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments.
Application kernel, written in Go, that implements a substantial portion of the Linux system surface to provide an isolation boundary between the application and the host kernel.
Kubernetes
Query and validate several common security-related configuration settings of managed Kubernetes cluster objects and the workloads/resources running inside the cluster.
Kubernetes controller and tool for one-way encrypted Secrets.
Utility that exposes the expiry of TLS certificates as Prometheus metrics.
Workload policy enforcement tool for Kubernetes.
Allows a cluster administrator to dump the current state of a running pod and all its containers so that security professionals can perform off-line forensic analysis.
Allows exporting the often missed Kubernetes events to various outputs so that they can be used for observability or alerting purposes.
Open-source tool that runs a set of tests ("hunters") for security issues in Kubernetes clusters from either outside ("attacker's view") or inside a cluster.
Communications security (COMSEC)
DevSecOps
Custom and better AppArmor profile generator for Docker containers.
Safely store secrets in Git/Mercurial/Subversion by encrypting them "at rest" using GnuPG.
Static analysis tool to probe for vulnerabilities introduced via application container (e.g., Docker) images.
Prevents you from committing passwords and other sensitive information to a git repository.
Editor of encrypted files that supports YAML, JSON, ENV, INI and binary formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, and PGP.
Simple and comprehensive vulnerability scanner for containers and other artifacts, suitable for use in continuous integration pipelines.
Helm plugin that helps manage secrets with Git workflow and stores them anywhere, backed by SOPS.
Static analysis security scanner for your Terraform code designed to run locally and in CI pipelines.
Dependency confusion
Open source, modular and extensible framework to detect and prevent dependency confusion leakage and potential attacks.
Script to check if you have artifacts containing the same name between your repositories.
Prevent and detect if you're vulnerable to dependency confusion supply chain security attacks.
Policy enforcement
Honeypots
Self-hostable honeytoken generator and reporting dashboard; demo version available at CanaryTokens.org.
Open-sources intelligence (OSINT) honeypot that monitors reconnaissance attempts by threat actors and generates actionable intelligence for Blue Teamers.
Host-based tools
Incident Response tools
IR management consoles
Scriptable Digital Forensics and Incident Response (DFIR) toolkit built on Viper.
Cybersecurity incident management platform allowing for easy creation, tracking, and reporting of cybersecurity incidents.
Web application built by Defense Point Security to allow security researchers the ability to add and retrieve indicators related to their research.
Evidence collection
Modular, automated forensic triage collection framework designed to access various forensic artifacts on macOS, parse them, and present them in formats viable for analysis.
Free macOS computer forensics tool.
Forensic evidence collection & analysis toolkit for macOS.
Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
Command line utility (that works with or without Amazon EC2 instances) to parallelize remote memory acquisition.
Assists incident response teams by exporting cloud artifacts from Azure/AzureAD/M365 environments in order to run a full investigation despite lacking in logs ingested by a SIEM.
Network perimeter defenses
Phishing awareness and reporting
Certificate Transparency log monitor from SSLMate that alerts you when a SSL/TLS certificate is issued for one of your domains.
Tool for testing and promoting user awareness by simulating real world phishing attacks.
Outlook add-in used to help your users to report suspicious e-mails to security teams.
Framework that will assist with the detection and response to phishing attacks.
Platform allowing to create and manage (fake) phishing campaigns intended to train people in identifying suspicious mails.
Scans SPF and DMARC records for issues that could allow email spoofing.
Configurable script to watch for issuances of suspicious TLS certificates by domain name in the Certificate Transparency Log (CTL) using the CertStream service.
Framework that will assist with the detection and response to phishing attacks.
Preparedness training and wargaming
Toolset to make a system look as if it was the victim of an APT attack.
Modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events for Blue Team drills and sensor/alert mapping.
Automated information security preparedness tool to do adversarial simulation.
Utility to generate malicious network traffic and help security teams evaluate security controls and audit their network visibility.
Ubuntu-based Open Virtual Appliance (.ova) preconfigured with several threat emulation tools as well as a defender's toolkit.
Security configurations
Security monitoring
Network Security Monitoring (NSM)
Augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access.
Framework to aid analysts in the creation and execution of pynids-based decoders and detectors of APT tradecraft.
Malicious network traffic detection system.
Open source framework for network traffic analysis that ingests Zeek logs and detects beaconing, DNS tunneling, and more.
Detects the presence of the Responder LLMNR/NBT-NS/MDNS poisoner on a network.
Catch spoofed NetBIOS Name Service (NBNS) responses and alert to an email or log file.
Full-packet-capture utility for buffering packets to disk for intrusion detection and incident response purposes.
General purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.
Free and open-source network telemetry engine for data-driven security investigations.
General purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.
Service and performance monitoring
Threat hunting
Suite of CIM/WMI-based tools enabling remote incident response and hunting operations across all versions of Windows.
PowerShell module for hunt teaming via Windows Event logs.
Incident response framework focused on remote live forensics consisting of a Python agent installed on assets and Python-based server infrastructure enabling analysts to quickly triage attacks and perform analysis remotely.
All-in-one Free Software threat hunting stack based on Elasticsearch, Logstash, Kafka, and Kibana with various built-in integrations for analytics including Jupyter Notebook.
Automate the security incident handling process and facilitate the real-time activities of incident handlers.
PowerShell module designed to scan remote endpoints for indicators of compromise or survey them for more comprehensive information related to state of those systems.
PSHunt-like tool for analyzing remote Windows systems that also produces a self-contained HTML report of its findings.
All in one PowerShell-based platform to perform live hard disk forensic analysis.
Multi-platform tool for triaging suspected IOCs on many endpoints simultaneously and that integrates with antivirus consoles.
Threat intelligence
Credential phish analysis and automation tool that can accept suspected phishing URLs directly or trigger on observed network traffic containing such a URL.
Multi-threaded threat intelligence gathering built with Python3 featuring simple text-based configuration and data storage for ease of use and data portability.
Provides IP network situational awareness of industrial control systems (ICS) and Supervisory Control and Data Acquisition (SCADA) by passively mapping, accounting for, and reporting on your ICS/SCADA network topology and endpoints.
Gather and combine multiple threat intelligence feed sources into one customizable, standardized CSV-based format.
Generic signature format for SIEM systems, offering an open signature format that allows you to describe relevant log events in a straightforward manner.
Threat intelligence dissemination layer to connect security tools through a distributed publish/subscribe message broker.
Extendable tool to extract and aggregate IOCs from threat feeds including Twitter, RSS feeds, or other sources.
Binary analysis and management framework enabling easy organization of malware and exploit samples.
Tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples, described as "the pattern matching swiss army knife" for file patterns and signatures.
Fingerprinting
Threat signature packages and collections
Indicators of Compromises (IOCs) derived from ESET's various investigations.
Collection of Snort and YARA rules to detect attacks carried out with FireEye's own Red Team tools, first released after FireEye disclosed a breach in December 2020.
Collection of IoC in various languages for detecting backdoored SolarWinds Orion NMS activities and related vulnerabilities.
Project covering the need for IT security researchers to have a single repository where different Yara signatures are compiled, classified and kept as up to date as possible.
Tor Onion service defenses
Transport-layer defenses
Overlay and Virtual Private Networks (VPNs)
Open source, self-hosted implementation of the Tailscale control server.
Scripts to build your own IPsec VPN server, with IPsec/L2TP, Cisco IPsec and IKEv2.
Free Software private network system that uses WireGuard under the hood, made to be self-hosted.
Completely open source and self-hosted, scalable overlay networking tool with a focus on performance, simplicity, and security, inspired by tinc.
Open source initiative focused on bringing Zero Trust to any application via an overlay network, tunelling applications, and numerous SDKs.
macOS-based defenses
Keep track of binaries that are naughty or nice in an allow/deny-listing system for macOS.
Easily configure macOS security settings from the terminal.
Automated configuration of kernel-level, OS-level, and client-level security features including privatizing proxying and anti-virus scanning for macOS.
Windows-based defenses
Scan files or process memory for Cobalt Strike beacons and parse their configuration.
Utility that disables a number of risky Windows features.
Detect both client-side rules and VBScript enabled forms used by the Ruler attack tool when attempting to compromise a Microsoft Exchange server.
Establishes a Windows RDP session from a list of hostnames and scans for accessibility tools backdoors, alerting if one is discovered.
Group Policy objects, compliance checks, and configuration tools that provide an automated and flexible approach for securely deploying and maintaining the latest releases of Windows 10.
Log newly created WMI consumers and processes to the Windows Application event log.
Active Directory
Visualize and graph Active Directory permission configs ("control relations") to audit questions such as "Who can read the CEO's email?" and similar.
More effectively use BloodHoundAD in continual security life-cycles by utilizing its pathfinding engine to identify Active Directory security vulnerabilities.