Skip to content

Commit

Permalink
add tools + github updates
Browse files Browse the repository at this point in the history
  • Loading branch information
@mthcht
mthcht committed Jun 17, 2024
1 parent 6501ddf commit 7174374
Show file tree
Hide file tree
Showing 1,186 changed files with 93,612 additions and 82,713 deletions.
7,703 changes: 3,969 additions & 3,734 deletions greyware_tool_keyword.csv
View file

Large diffs are not rendered by default.

48,662 changes: 24,904 additions & 23,758 deletions offensive_tool_keyword.csv
View file

Large diffs are not rendered by default.

1,425 changes: 1,379 additions & 46 deletions only_keywords.txt
View file

Large diffs are not rendered by default.

1,425 changes: 1,379 additions & 46 deletions only_keywords_regex.txt
View file

Large diffs are not rendered by default.

1,450 changes: 1,390 additions & 60 deletions only_keywords_regex_better_perf.txt
View file

Large diffs are not rendered by default.

2,728 changes: 2,728 additions & 0 deletions release_notes/Release_20240617.csv
View file

Large diffs are not rendered by default.

58 changes: 29 additions & 29 deletions signature_keyword.csv
View file

Large diffs are not rendered by default.

56,423 changes: 28,902 additions & 27,521 deletions threathunting-keywords.csv
View file

Large diffs are not rendered by default.

656 changes: 328 additions & 328 deletions tools/A-C/AADInternals.csv
View file

Large diffs are not rendered by default.

48 changes: 24 additions & 24 deletions tools/A-C/ACLight.csv
View file

Large diffs are not rendered by default.

40 changes: 20 additions & 20 deletions tools/A-C/ADACLScanner.csv
View file

Large diffs are not rendered by default.

32 changes: 16 additions & 16 deletions tools/A-C/ADCSCoercePotato.csv
View file
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
"keyword","metadata_keyword_regex","metadata_keyword_type","metadata_tool","metadata_description","metadata_tool_techniques","metadata_tool_tactics","metadata_malwares_name","metadata_groups_name","metadata_category","metadata_link","metadata_enable_endpoint_detection","metadata_enable_proxy_detection","metadata_comment","metadata_severity_score","metadata_popularity_score","metadata_github_stars","metadata_github_forks","metadata_github_updated_at","metadata_github_created_at"
"*.asp --adcs --template Machine -smb2support*",".{0,1000}\.asp\s\-\-adcs\s\-\-template\sMachine\s\-smb2support.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*/ADCSCoercePotato.git*",".{0,1000}\/ADCSCoercePotato\.git.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*/ADCSCoercePotato/*",".{0,1000}\/ADCSCoercePotato\/.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*[!] Couldn't communicate with the fake RPC Server*",".{0,1000}\[!\]\sCouldn\'t\scommunicate\swith\sthe\sfake\sRPC\sServer.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*[+] Got NTLM type 3 AUTH message from * with hostname *",".{0,1000}\[\+\]\sGot\sNTLM\stype\s3\sAUTH\smessage\sfrom\s.{0,1000}\s\swith\shostname\s.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*\ADCSCoercePotato\*",".{0,1000}\\ADCSCoercePotato\\.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*\MSFRottenPotato.h*",".{0,1000}\\MSFRottenPotato\.h.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*4164003E-BA47-4A95-8586-D5AAC399C050*",".{0,1000}4164003E\-BA47\-4A95\-8586\-D5AAC399C050.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*ADCSCoercePotato.cpp*",".{0,1000}ADCSCoercePotato\.cpp.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*ADCSCoercePotato.exe*",".{0,1000}ADCSCoercePotato\.exe.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*ADCSCoercePotato.sln*",".{0,1000}ADCSCoercePotato\.sln.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*ADCSCoercePotato.vcxproj*",".{0,1000}ADCSCoercePotato\.vcxproj.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*ADCSCoercePotato\n- @decoder_it 2024\*",".{0,1000}ADCSCoercePotato\\n\-\s\@decoder_it\s2024\\.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*decoder-it/ADCSCoercePotato*",".{0,1000}decoder\-it\/ADCSCoercePotato.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*include ""MSFRottenPotato.h""*",".{0,1000}include\s\""MSFRottenPotato\.h\"".{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*int PotatoAPI::findNTLMBytes*",".{0,1000}int\sPotatoAPI\:\:findNTLMBytes.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","190","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*.asp --adcs --template Machine -smb2support*",".{0,1000}\.asp\s\-\-adcs\s\-\-template\sMachine\s\-smb2support.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*/ADCSCoercePotato.git*",".{0,1000}\/ADCSCoercePotato\.git.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*/ADCSCoercePotato/*",".{0,1000}\/ADCSCoercePotato\/.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*[!] Couldn't communicate with the fake RPC Server*",".{0,1000}\[!\]\sCouldn\'t\scommunicate\swith\sthe\sfake\sRPC\sServer.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*[+] Got NTLM type 3 AUTH message from * with hostname *",".{0,1000}\[\+\]\sGot\sNTLM\stype\s3\sAUTH\smessage\sfrom\s.{0,1000}\s\swith\shostname\s.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*\ADCSCoercePotato\*",".{0,1000}\\ADCSCoercePotato\\.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*\MSFRottenPotato.h*",".{0,1000}\\MSFRottenPotato\.h.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*4164003E-BA47-4A95-8586-D5AAC399C050*",".{0,1000}4164003E\-BA47\-4A95\-8586\-D5AAC399C050.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*ADCSCoercePotato.cpp*",".{0,1000}ADCSCoercePotato\.cpp.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*ADCSCoercePotato.exe*",".{0,1000}ADCSCoercePotato\.exe.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*ADCSCoercePotato.sln*",".{0,1000}ADCSCoercePotato\.sln.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*ADCSCoercePotato.vcxproj*",".{0,1000}ADCSCoercePotato\.vcxproj.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*ADCSCoercePotato\n- @decoder_it 2024\*",".{0,1000}ADCSCoercePotato\\n\-\s\@decoder_it\s2024\\.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*decoder-it/ADCSCoercePotato*",".{0,1000}decoder\-it\/ADCSCoercePotato.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","1","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*include ""MSFRottenPotato.h""*",".{0,1000}include\s\""MSFRottenPotato\.h\"".{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
"*int PotatoAPI::findNTLMBytes*",".{0,1000}int\sPotatoAPI\:\:findNTLMBytes.{0,1000}","offensive_tool_keyword","ADCSCoercePotato","coercing machine authentication but specific for ADCS server","T1187","TA0006","N/A","N/A","Credential Access","https://github.com/decoder-it/ADCSCoercePotato","1","0","N/A","10","2","191","25","2024-05-05T14:42:23Z","2024-02-26T12:08:34Z"
8 changes: 4 additions & 4 deletions tools/A-C/ADCSKiller.csv
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
"keyword","metadata_keyword_regex","metadata_keyword_type","metadata_tool","metadata_description","metadata_tool_techniques","metadata_tool_tactics","metadata_malwares_name","metadata_groups_name","metadata_category","metadata_link","metadata_enable_endpoint_detection","metadata_enable_proxy_detection","metadata_comment","metadata_severity_score","metadata_popularity_score","metadata_github_stars","metadata_github_forks","metadata_github_updated_at","metadata_github_created_at"
"*/ADCSKiller*",".{0,1000}\/ADCSKiller.{0,1000}","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","683","69","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
"*adcskiller.py*",".{0,1000}adcskiller\.py.{0,1000}","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","683","69","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
"*ly4k/Certipy*",".{0,1000}ly4k\/Certipy.{0,1000}","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","683","69","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
"*p0dalirius/Coercer*",".{0,1000}p0dalirius\/Coercer.{0,1000}","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","683","69","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
"*/ADCSKiller*",".{0,1000}\/ADCSKiller.{0,1000}","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","685","69","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
"*adcskiller.py*",".{0,1000}adcskiller\.py.{0,1000}","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","685","69","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
"*ly4k/Certipy*",".{0,1000}ly4k\/Certipy.{0,1000}","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","685","69","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
"*p0dalirius/Coercer*",".{0,1000}p0dalirius\/Coercer.{0,1000}","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","685","69","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
Loading

0 comments on commit 7174374

Please sign in to comment.