[[
wikihub
]]
Search
⌘K
Explore
People
For Agents
Sign in
Explore
People
For Agents
Sign in
@harrisonqian / Awesome / wiki/security/cybersecurity-blue-team.md
Suggest edit
Cancel
Submit suggestion
Title
Name
Note
--- visibility: public --- # Cybersecurity Blue Team **repo:** [fabacab/awesome-cybersecurity-blueteam](https://github.com/fabacab/awesome-cybersecurity-blueteam) **category:** [[security|Security]] --- # Awesome Cybersecurity Blue Team [](https://awesome.re) > A collection of awesome resources, tools, and other shiny things for cybersecurity blue teams. [Cybersecurity blue teams](https://en.wikipedia.org/wiki/Blue_team_(computer_security)) are groups of individuals who identify security flaws in information technology systems, verify the effectiveness of security measures, and monitor the systems to ensure that implemented defensive measures remain effective in the future. While not exclusive, this list is heavily biased towards [Free Software](https://www.gnu.org/philosophy/free-sw.html) projects and against proprietary products or corporate services. For offensive TTPs, please see [awesome-pentest](https://github.com/fabacab/awesome-pentest). Your contributions and suggestions are heartily ♥ welcome. (✿◕‿◕). Please check the [Contributing Guidelines](CONTRIBUTING.md) for more details. This work is licensed under a [Creative Commons Attribution 4.0 International License](http://creativecommons.org/licenses/by/4.0/). Many cybersecurity professionals enable racist state violence, wittingly or unwittingly, by providing services to local, state, and federal policing agencies or otherwise cooperating with similar institutions who do so. This evil most often happens through the coercive mechanism of employment under threat of lack of access to food, shelter, or healthcare. Despite this list's public availability, it is the maintainer's intention and hope that this list supports the people and organizations who work to counter such massive albeit banal evil.   **[DEFUND THE POLICE.](https://defundthepolice.org/)** ## Contents - [Automation and Convention](#automation-and-convention) - [Code libraries and bindings](#code-libraries-and-bindings) - [Security Orchestration, Automation, and Response (SOAR)](#[security](/@harrisonqian/awesome/wiki/security/security)-orchestration-automation-and-response-soar) - [Cloud platform security](#cloud-platform-security) - [Distributed monitoring](#distributed-monitoring) - [Kubernetes](#kubernetes) - [Service meshes](#service-meshes) - [Communications [security](/@harrisonqian/awesome/wiki/security/security) (COMSEC)](#communications-security-comsec) - [DevSecOps](#devsecops) - [Application or Binary Hardening](#application-or-binary-hardening) - [Compliance [testing](/@harrisonqian/awesome/wiki/testing/testing) and reporting](#compliance-testing-and-reporting) - [Dependency confusion](#dependency-confusion) - [Fuzzing](#fuzzing) - [Policy enforcement](#policy-enforcement) - [Supply chain security](#supply-chain-security) - [Honeypots](#honeypots) - [Tarpits](#tarpits) - [Host-based tools](#host-based-tools) - [Sandboxes](#sandboxes) - [Identity and AuthN/AuthZ](#identity-and-authnauthz) - [Incident Response tools](#incident-response-tools) - [IR management consoles](#ir-management-consoles) - [Evidence collection](#evidence-collection) - [Network perimeter defenses](#network-perimeter-defenses) - [Firewall appliances or distributions](#firewall-appliances-or-distributions) - [Operating System distributions](#operating-system-distributions) - [Phishing awareness and reporting](#phishing-awareness-and-reporting) - [Preparedness training and wargaming](#preparedness-training-and-wargaming) - [Post-engagement analysis and reporting](#post-engagement-analysis-and-reporting) - [Security configurations](#[security](/@harrisonqian/awesome/wiki/security/security)-configurations) - [Security monitoring](#[security](/@harrisonqian/awesome/wiki/security/security)-monitoring) - [Endpoint Detection and Response (EDR)](#endpoint-detection-and-response-edr) - [Network [Security](/@harrisonqian/awesome/wiki/security/security) Monitoring (NSM)](#network-security-monitoring-nsm) - [Security Information and Event Management (SIEM)](#[security](/@harrisonqian/awesome/wiki/security/security)-information-and-event-management-siem) - [Service and performance monitoring](#service-and-performance-monitoring) - [Threat hunting](#threat-hunting) - [Threat intelligence](#threat-intelligence) - [Fingerprinting](#fingerprinting) - [Threat signature packages and collections](#threat-signature-packages-and-collections) - [Tor Onion service defenses](#tor-onion-service-defenses) - [Transport-layer defenses](#transport-layer-defenses) - [Overlay and Virtual Private Networks (VPNs)](#overlay-and-virtual-private-networks-vpns) - [macOS-based defenses](#macos-based-defenses) - [Windows-based defenses](#[windows](/@harrisonqian/awesome/wiki/platforms/windows)-based-defenses) - [Active Directory](#active-directory) ## Automation and Convention - [Ansible Lockdown](https://ansiblelockdown.io/) - Curated collection of information [security](/@harrisonqian/awesome/wiki/security/security) themed [Ansible](/@harrisonqian/awesome/wiki/miscellaneous/ansible) roles that are both vetted and actively maintained. - [Clevis](https://github.com/latchset/clevis) - Plugable framework for automated decryption, often used as a Tang client. - [DShell](https://github.com/USArmyResearchLab/Dshell) - Extensible network forensic analysis framework written in [Python](/@harrisonqian/awesome/wiki/programming-languages/python) that enables rapid development of plugins to support the dissection of network packet captures. - [Dev-Sec.io](https://dev-sec.io/) - Server hardening framework providing [Ansible](/@harrisonqian/awesome/wiki/miscellaneous/ansible), Chef, and Puppet implementations of various baseline [security](/@harrisonqian/awesome/wiki/security/security) configurations. - [Password Manager Resources](https://github.com/apple/password-manager-resources) - Collaborative, crowd-sourced data and code to make password management better. - [peepdf](https://eternal-todo.com/tools/peepdf-pdf-analysis-tool) - [Scriptable](/@harrisonqian/awesome/wiki/miscellaneous/scriptable) PDF file analyzer. - [PyREBox](https://talosintelligence.com/pyrebox) - [Python](/@harrisonqian/awesome/wiki/programming-languages/python)-[scriptable](/@harrisonqian/awesome/wiki/miscellaneous/scriptable) reverse engineering sandbox, based on QEMU. - [Watchtower](https://containrrr.dev/watchtower/) - Container-based solution for automating [Docker](/@harrisonqian/awesome/wiki/back-end-development/docker) container base image updates, providing an unattended upgrade experience. ### Code libraries and bindings - [MultiScanner](https://github.com/mitre/multiscanner) - File analysis framework written in [Python](/@harrisonqian/awesome/wiki/programming-languages/python) that assists in evaluating a set of files by automatically running a suite of tools against them and aggregating the output. - [Posh-VirusTotal](https://github.com/darkoperator/Posh-VirusTotal) - [PowerShell](/@harrisonqian/awesome/wiki/development-environment/powershell) interface to VirusTotal.com APIs. - [censys-python](https://github.com/censys/censys-python) - [Python](/@harrisonqian/awesome/wiki/programming-languages/python) wrapper to the Censys [REST](/@harrisonqian/awesome/wiki/miscellaneous/rest) API. - [libcrafter](https://github.com/pellegre/libcrafter) - High level C++ network packet sniffing and crafting library. - [python-dshield](https://github.com/rshipp/python-dshield) - Pythonic interface to the Internet Storm Center/DShield API. - [python-sandboxapi](https://github.com/InQuest/python-sandboxapi) - Minimal, consistent [Python](/@harrisonqian/awesome/wiki/programming-languages/python) API for building integrations with malware sandboxes. - [python-stix2](https://github.com/oasis-open/cti-[python](/@harrisonqian/awesome/wiki/programming-languages/python)-stix2) - [Python](/@harrisonqian/awesome/wiki/programming-languages/python) APIs for serializing and de-serializing Structured Threat Information eXpression (STIX) [JSON](/@harrisonqian/awesome/wiki/miscellaneous/json) content, plus higher-level APIs for common tasks. ### Security Orchestration, Automation, and Response (SOAR) See also [Security Information and Event Management (SIEM)](#security-information-and-event-management-siem), and [IR management consoles](#ir-management-consoles). - [Shuffle](https://shuffler.io/) - Graphical generalized workflow (automation) builder for IT professionals and blue teamers. ## Cloud platform security See also [asecure.cloud/tools](https://asecure.cloud/tools/). - [Aaia](https://github.com/rams3sh/Aaia) - Helps in visualizing AWS IAM and Organizations in a graph format with help of [Neo4j](/@harrisonqian/awesome/wiki/databases/neo4j). - [Falco](https://falco.org/) - Behavioral activity monitor designed to detect anomalous activity in containerized applications, hosts, and network packet flows by auditing the [Linux](/@harrisonqian/awesome/wiki/platforms/linux) kernel and enriched by runtime data such as [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes) metrics. - [Kata Containers](https://katacontainers.io/) - Secure container runtime with lightweight virtual machines that feel and perform like [containers](/@harrisonqian/awesome/wiki/platforms/containers), but provide stronger workload isolation using hardware virtualization technology as a second layer of defense. - [Principal Mapper (PMapper)](https://github.com/nccgroup/PMapper) - Quickly evaluate IAM permissions in AWS via script and library capable of identifying risks in the configuration of AWS Identity and Access Management (IAM) for an AWS account or an AWS organization. - [Prowler](https://github.com/toniblyx/prowler) - Tool based on AWS-CLI commands for [Amazon Web Services](/@harrisonqian/awesome/wiki/platforms/amazon-web-services) account [security](/@harrisonqian/awesome/wiki/security/security) assessment and hardening. - [Scout Suite](https://github.com/nccgroup/ScoutSuite) - Open source multi-cloud [security](/@harrisonqian/awesome/wiki/security/security)-auditing tool, which enables [security](/@harrisonqian/awesome/wiki/security/security) posture assessment of cloud environments. - [gVisor](https://github.com/google/gvisor) - Application kernel, written in Go, that implements a substantial portion of the [Linux](/@harrisonqian/awesome/wiki/platforms/linux) system surface to provide an isolation boundary between the application and the host kernel. ### Distributed monitoring See also [§ Service and performance monitoring](#service-and-performance-monitoring). - [Cortex](https://cortexmetrics.io/) - Provides horizontally scalable, highly available, multi-tenant, long term storage for [Prometheus](/@harrisonqian/awesome/wiki/miscellaneous/prometheus). - [Jaeger](https://www.jaegertracing.io/) - Distributed tracing platform backend used for monitoring and troubleshooting [microservices](/@harrisonqian/awesome/wiki/miscellaneous/microservices)-based distributed systems. - [OpenTelemetry](https://opentelemetry.io/) - Observability framework for cloud-native software, comprising a collection of tools, APIs, and SDKs for exporting application performance metrics to a tracing backend (formerly maintained by the OpenTracing and OpenCensus projects). - [Prometheus](https://prometheus.io/) - Open-source systems monitoring and alerting toolkit originally built at SoundCloud. - [Zipkin](https://zipkin.io/) - Distributed tracing system backend that helps gather timing data needed to troubleshoot latency problems in service architectures. ### Kubernetes See also [Kubernetes-Security.info](https://kubernetes-security.info/). - [KubeSec](https://kubesec.io/) - Static analyzer of [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes) manifests that can be run locally, as a Kuberenetes admission controller, or as its own cloud service. - [Kyverno](https://kyverno.io/) - Policy engine designed for [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes). - [Linkerd](https://linkerd.io/) - Ultra light [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes)-specific service mesh that adds observability, reliability, and [security](/@harrisonqian/awesome/wiki/security/security) to [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes) applications without requiring any modification of the application itself. - [Managed [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes) Inspection Tool (MKIT)](https://github.com/darkbitio/mkit) - Query and validate several common [security](/@harrisonqian/awesome/wiki/security/security)-related configuration settings of managed Kubernetes cluster objects and the workloads/resources running inside the cluster. - [Polaris](https://polaris.docs.fairwinds.com/) - Validates [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes) best practices by running tests against code commits, a Kubernetes admission request, or live resources already running in a cluster. - [Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets) - [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes) controller and tool for one-way encrypted Secrets. - [certificate-expiry-monitor](https://github.com/muxinc/certificate-expiry-monitor) - Utility that exposes the expiry of TLS [certificates](/@harrisonqian/awesome/wiki/learn/certificates) as [Prometheus](/@harrisonqian/awesome/wiki/miscellaneous/prometheus) metrics. - [k-rail](https://github.com/cruise-automation/k-rail) - Workload policy enforcement tool for [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes). - [kube-forensics](https://github.com/keikoproj/kube-forensics) - Allows a cluster administrator to dump the current state of a running pod and all its [containers](/@harrisonqian/awesome/wiki/platforms/containers) so that [security](/@harrisonqian/awesome/wiki/security/security) professionals can perform off-line forensic analysis. - [kube-hunter](https://kube-hunter.aquasec.com/) - Open-source tool that runs a set of tests ("hunters") for [security](/@harrisonqian/awesome/wiki/security/security) issues in [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes) clusters from either outside ("attacker's view") or inside a cluster. - [kubernetes-event-exporter](https://github.com/opsgenie/kubernetes-event-exporter) - Allows exporting the often missed [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes) events to various outputs so that they can be used for observability or alerting purposes. ### Service meshes See also [ServiceMesh.es](https://servicemesh.es/). - [Consul](https://consul.io/) - Solution to connect and configure applications across dynamic, distributed infrastructure and, with Consul Connect, enabling secure service-to-service communication with automatic TLS encryption and identity-based authorization. - [Istio](https://istio.io/) - Open platform for providing a uniform way to integrate [microservices](/@harrisonqian/awesome/wiki/miscellaneous/microservices), manage traffic flow across [microservices](/@harrisonqian/awesome/wiki/miscellaneous/microservices), enforce policies and aggregate telemetry data. ## Communications security (COMSEC) See also [Transport-layer defenses](#transport-layer-defenses). - [GPG Sync](https://github.com/firstlookmedia/gpgsync) - Centralize and automate OpenPGP public key distribution, revocation, and updates amongst all members of an organization or team. - [Geneva (Genetic Evasion)](https://censorship.ai/) - Novel experimental genetic algorithm that evolves packet-manipulation-based censorship evasion strategies against nation-state level censors to increase availability of otherwise blocked content. - [GlobaLeaks](https://www.globaleaks.org/) - Free, open source software enabling anyone to easily set up and maintain a secure whistleblowing platform. - [SecureDrop](https://securedrop.org/) - Open source whistleblower submission system that media organizations and NGOs can install to securely accept documents from anonymous sources. - [Teleport](https://goteleport.com/) - Allows engineers and [security](/@harrisonqian/awesome/wiki/security/security) professionals to unify access for SSH servers, [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes) clusters, web applications, and databases across all environments. ## DevSecOps See also [awesome-devsecops](https://github.com/devsecops/awesome-devsecops). - [Bane](https://github.com/genuinetools/bane) - Custom and better AppArmor profile generator for [Docker](/@harrisonqian/awesome/wiki/back-end-development/docker) [containers](/@harrisonqian/awesome/wiki/platforms/containers). - [BlackBox](https://github.com/StackExchange/blackbox) - Safely store secrets in Git/Mercurial/Subversion by encrypting them "at [rest](/@harrisonqian/awesome/wiki/miscellaneous/rest)" using GnuPG. - [Checkov](https://www.checkov.io/) - Static analysis for [Terraform](/@harrisonqian/awesome/wiki/back-end-development/terraform) (infrastructure as code) to help detect CIS policy violations and prevent cloud [security](/@harrisonqian/awesome/wiki/security/security) misconfiguration. - [Cilium](https://cilium.io/) - Open source software for transparently securing the network connectivity between application services deployed using [Linux](/@harrisonqian/awesome/wiki/platforms/linux) container management platforms like [Docker](/@harrisonqian/awesome/wiki/back-end-development/docker) and [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes). - [Clair](https://github.com/coreos/clair) - Static analysis tool to probe for vulnerabilities introduced via application container (e.g., Docker) images. - [CodeQL](https://securitylab.[github](/@harrisonqian/awesome/wiki/development-environment/github).com/tools/codeql) - Discover vulnerabilities across a codebase by performing queries against code as though it were data. - [DefectDojo](https://www.defectdojo.org/) - Application vulnerability management tool built for DevOps and continuous [security](/@harrisonqian/awesome/wiki/security/security) [integration](/@harrisonqian/awesome/wiki/platforms/integration). - [Gauntlt](http://gauntlt.org/) - Pentest applications during routine continuous [integration](/@harrisonqian/awesome/wiki/platforms/integration) build pipelines. - [Git Secrets](https://github.com/awslabs/git-secrets) - Prevents you from committing passwords and other sensitive information to a git repository. - [SOPS](https://github.com/mozilla/sops) - Editor of encrypted files that supports YAML, [JSON](/@harrisonqian/awesome/wiki/miscellaneous/json), ENV, INI and binary formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, and PGP. - [Snyk](https://snyk.io/) - Finds and fixes vulnerabilities and license violations in open source dependencies and container images. - [SonarQube](https://sonarqube.org) - Continuous inspection tool that provides detailed reports during automated [testing](/@harrisonqian/awesome/wiki/testing/testing) and alerts on newly introduced [security](/@harrisonqian/awesome/wiki/security/security) vulnerabilities. - [Trivy](https://github.com/aquasecurity/trivy) - Simple and comprehensive vulnerability scanner for [containers](/@harrisonqian/awesome/wiki/platforms/containers) and other artifacts, suitable for use in continuous [integration](/@harrisonqian/awesome/wiki/platforms/integration) pipelines. - [Vault](https://www.vaultproject.io/) - Tool for securely accessing secrets such as API keys, passwords, or [certificates](/@harrisonqian/awesome/wiki/learn/certificates) through a unified interface. - [git-crypt](https://www.agwa.name/projects/git-crypt/) - Transparent file encryption in git; files which you choose to protect are encrypted when committed, and decrypted when checked out. - [helm-secrets](https://github.com/jkroepke/helm-secrets) - Helm plugin that helps manage secrets with Git workflow and stores them anywhere, backed by SOPS. - [terrascan](https://runterrascan.io/) - Static code analyzer for Infrastructure as Code tools that helps detect compliance and [security](/@harrisonqian/awesome/wiki/security/security) violations to mitigate risk before provisioning cloud native resources. - [tfsec](https://aquasecurity.[github](/@harrisonqian/awesome/wiki/development-environment/github).io/tfsec/) - Static analysis [security](/@harrisonqian/awesome/wiki/security/security) scanner for your [Terraform](/@harrisonqian/awesome/wiki/back-end-development/terraform) code designed to run locally and in CI pipelines. ### Application or Binary Hardening - [DynInst](https://dyninst.org/dyninst) - Tools for binary instrumentation, analysis, and modification, useful for binary patching. - [DynamoRIO](https://dynamorio.org/) - Runtime code manipulation system that supports code transformations on any part of a program, while it executes, implemented as a process-level virtual machine. - [Egalito](https://egalito.org/) - Binary recompiler and instrumentation framework that can fully disassemble, transform, and regenerate ordinary [Linux](/@harrisonqian/awesome/wiki/platforms/linux) binaries designed for binary hardening and [security](/@harrisonqian/awesome/wiki/security/security) research. - [Valgrind](https://www.valgrind.org/) - Instrumentation framework for building dynamic analysis tools. ### Compliance testing and reporting - [Chef InSpec](https://www.chef.io/products/chef-inspec) - Language for describing [security](/@harrisonqian/awesome/wiki/security/security) and compliance rules, which become automated tests that can be run against IT infrastructures to discover and report on non-compliance. - [OpenSCAP Base](https://www.open-scap.org/tools/openscap-base/) - Both a library and a command line tool (`oscap`) used to evaluate a system against SCAP baseline profiles to report on the [security](/@harrisonqian/awesome/wiki/security/security) posture of the scanned system(s). ### Dependency confusion See also [§ Supply chain security](#supply-chain-security). - [Dependency Combobulator](https://github.com/apiiro/combobulator) - Open source, modular and extensible framework to detect and prevent dependency confusion leakage and potential attacks. - [Confusion checker](https://github.com/sonatype-nexus-community/repo-diff) - Script to check if you have artifacts containing the same name between your repositories. - [snync](https://github.com/snyk-labs/snync) - Prevent and detect if you're vulnerable to dependency confusion supply chain [security](/@harrisonqian/awesome/wiki/security/security) attacks. ### Fuzzing See also [Awesome-Fuzzing](https://github.com/secfigo/Awesome-Fuzzing). * [Atheris](https://pypi.org/project/atheris/) - Coverage-guided [Python](/@harrisonqian/awesome/wiki/programming-languages/python) [fuzzing](/@harrisonqian/awesome/wiki/security/fuzzing) engine based off of libFuzzer that supports [fuzzing](/@harrisonqian/awesome/wiki/security/fuzzing) of Python code but also native extensions written for CPython. * [FuzzBench](https://google.[github](/@harrisonqian/awesome/wiki/development-environment/github).io/fuzzbench/) - Free service that evaluates fuzzers on a wide variety of real-world benchmarks, at Google scale. * [OneFuzz](https://github.com/microsoft/onefuzz) - Self-hosted [Fuzzing](/@harrisonqian/awesome/wiki/security/fuzzing)-as-a-Service (FaaS) platform. ### Policy enforcement - [AllStar](https://github.com/ossf/allstar) - [GitHub](/@harrisonqian/awesome/wiki/development-environment/github) App installed on organizations or repositories to set and enforce [security](/@harrisonqian/awesome/wiki/security/security) policies. - [Conftest](https://conftest.dev/) - Utility to help you write tests against structured configuration data. - [Open Policy Agent (OPA)](https://www.openpolicyagent.org/) - Unified toolset and framework for policy across the cloud native stack. - [Regula](https://regula.dev/) - Checks infrastructure as code templates (Terraform, CloudFormation, K8s manifests) for AWS, Azure, [Google Cloud](/@harrisonqian/awesome/wiki/platforms/google-cloud), and [Kubernetes](/@harrisonqian/awesome/wiki/back-end-development/kubernetes) [security](/@harrisonqian/awesome/wiki/security/security) and compliance using Open Policy Agent/Rego. - [Tang](https://github.com/latchset/tang) - Server for binding data to network presence; provides data to clients only when they are on a certain (secured) network. ### Supply chain security See also [§ Dependency confusion](#dependency-confusion). - [Grafeas](https://grafeas.io/) - Open artifact metadata API to audit and govern your software supply chain. - [Helm GPG (GnuPG) Plugin](https://github.com/technosophos/helm-gpg) - Chart signing and verification with GnuPG for Helm. - [Notary](https://github.com/theupdateframework/notary) - Aims to make the internet more secure by making it easy for people to publish and verify content. - [in-toto](https://in-toto.io/) - Framework to secure the integrity of software supply chains. ## Honeypots See also [awesome-honeypots](https://github.com/paralax/awesome-honeypots). - [CanaryTokens](https://github.com/thinkst/canarytokens) - Self-hostable honeytoken generator and reporting dashboard; demo version available at [CanaryTokens.org](https://canarytokens.org/). - [Kushtaka](https://kushtaka.org) - Sustainable all-in-one honeypot and honeytoken orchestrator for under-resourced blue teams. - [Manuka](https://github.com/spaceraccoon/manuka) - Open-sources intelligence (OSINT) honeypot that monitors reconnaissance attempts by threat actors and generates actionable intelligence for Blue Teamers. ### Tarpits - [Endlessh](https://github.com/skeeto/endlessh) - SSH tarpit that slowly sends an endless banner. - [LaBrea](http://labrea.sourceforge.net/labrea-info.html) - Program that [answers](/@harrisonqian/awesome/wiki/miscellaneous/answers) ARP requests for unused IP space, creating the appearance of fake machines that answer further requests very slowly in order to slow down scanners, worms, etcetera. ## Host-based tools - [Artillery](https://github.com/BinaryDefense/artillery) - Combination honeypot, filesystem monitor, and alerting system designed to protect [Linux](/@harrisonqian/awesome/wiki/platforms/linux) and [Windows](/@harrisonqian/awesome/wiki/platforms/windows) operating systems. - [Crowd Inspect](https://www.crowdstrike.com/resources/community-tools/crowdinspect-tool/) - Free tool for [Windows](/@harrisonqian/awesome/wiki/platforms/windows) systems aimed to alert you to the presence of malware that may be communicating over the network. - [Fail2ban](https://www.fail2ban.org/) - Intrusion prevention software framework that protects computer servers from brute-force attacks. - [Open Source HIDS [SECurity](/@harrisonqian/awesome/wiki/security/security) (OSSEC)](https://www.ossec.net/) - Fully open source and free, feature-rich, Host-based Instrusion Detection System (HIDS). - [Rootkit Hunter (rkhunter)](http://rkhunter.sourceforge.net/) - POSIX-compliant Bash script that scans a host for various signs of malware. - [Shufflecake](https://shufflecake.net/) - Plausible deniability for multiple hidden filesystems on [Linux](/@harrisonqian/awesome/wiki/platforms/linux). - [USB Keystroke Injection Protection](https://github.com/google/ukip) - Daemon for blocking USB keystroke injection devices on [Linux](/@harrisonqian/awesome/wiki/platforms/linux) systems. - [chkrootkit](http://chkrootkit.org/) - Locally checks for signs of a rootkit on GNU/[Linux](/@harrisonqian/awesome/wiki/platforms/linux) systems. ### Sandboxes - [Bubblewrap](https://github.com/containers/bubblewrap) - Sandboxing tool for use by unprivileged [Linux](/@harrisonqian/awesome/wiki/platforms/linux) users capable of restricting access to parts of the operating system or user data. - [Dangerzone](https://dangerzone.rocks/) - Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF. - [Firejail](https://firejail.wordpress.com/) - SUID program that reduces the risk of [security](/@harrisonqian/awesome/wiki/security/security) breaches by restricting the running environment of untrusted applications using [Linux](/@harrisonqian/awesome/wiki/platforms/linux) namespaces and seccomp-bpf. ## Identity and AuthN/AuthZ - [Gluu Server](https://gluu.org/) - Central authentication and authorization for Web and mobile applications with a Free and Open Source Software cloud-native community distribution. ## Incident Response tools See also [awesome-incident-response](https://github.com/meirwah/awesome-incident-response). - [LogonTracer](https://github.com/JPCERTCC/LogonTracer) - Investigate malicious [Windows](/@harrisonqian/awesome/wiki/platforms/windows) logon by visualizing and analyzing [Windows](/@harrisonqian/awesome/wiki/platforms/windows) event log. - [Volatility](https://www.volatilityfoundation.org/) - Advanced memory forensics framework. - [aws_ir](https://github.com/ThreatResponse/aws_ir) - Automates your [incident response](/@harrisonqian/awesome/wiki/security/incident-response) with zero [security](/@harrisonqian/awesome/wiki/security/security) preparedness assumptions. ### IR management consoles See also [Security Orchestration, Automation, and Response (SOAR)](#security-orchestration-automation-and-response-soar). - [CIRTKit](https://github.com/opensourcesec/CIRTKit) - [Scriptable](/@harrisonqian/awesome/wiki/miscellaneous/scriptable) Digital Forensics and [Incident Response](/@harrisonqian/awesome/wiki/security/incident-response) (DFIR) toolkit built on Viper. - [Fast [Incident Response](/@harrisonqian/awesome/wiki/security/incident-response) (FIR)](https://github.com/certsocietegenerale/FIR) - Cybersecurity incident management platform allowing for easy creation, tracking, and reporting of cybersecurity incidents. - [Rekall](http://www.rekall-forensic.com/) - Advanced forensic and [incident response](/@harrisonqian/awesome/wiki/security/incident-response) framework. - [TheHive](https://thehive-project.org/) - Scalable, free [Security](/@harrisonqian/awesome/wiki/security/security) [Incident Response](/@harrisonqian/awesome/wiki/security/incident-response) Platform designed to make life easier for SOCs, CSIRTs, and CERTs, featuring tight [integration](/@harrisonqian/awesome/wiki/platforms/integration) with MISP. - [threat_note](https://github.com/defpoint/threat_note) - Web application built by Defense Point [Security](/@harrisonqian/awesome/wiki/security/security) to allow security researchers the ability to add and retrieve indicators related to their research. ### Evidence collection - [AutoMacTC](https://github.com/CrowdStrike/automactc) - Modular, automated forensic triage collection framework designed to access various forensic artifacts on macOS, parse them, and present them in formats viable for analysis. - [OSXAuditor](https://github.com/jipegit/OSXAuditor) - Free macOS computer forensics tool. - [OSXCollector](https://github.com/Yelp/osxcollector) - Forensic evidence collection & analysis toolkit for macOS. - [ir-rescue](https://github.com/diogo-fernan/ir-rescue) - [Windows](/@harrisonqian/awesome/wiki/platforms/windows) Batch script and a Unix Bash script to comprehensively collect host forensic data during [incident response](/@harrisonqian/awesome/wiki/security/incident-response). - [Margarita Shotgun](https://github.com/ThreatResponse/margaritashotgun) - Command line utility (that works with or without Amazon EC2 instances) to parallelize remote memory acquisition. - [Untitled Goose Tool](https://github.com/cisagov/untitledgoosetool) - Assists [incident response](/@harrisonqian/awesome/wiki/security/incident-response) teams by exporting cloud artifacts from Azure/AzureAD/M365 environments in order to run a full investigation despite lacking in logs ingested by a SIEM. ## Network perimeter defenses - [Gatekeeper](https://github.com/AltraMayor/gatekeeper) - First open source Distributed Denial of Service (DDoS) protection system. - [fwknop](https://www.cipherdyne.org/fwknop/) - Protects ports via Single Packet Authorization in your firewall. - [ssh-audit](https://github.com/jtesta/ssh-audit) - Simple tool that makes quick recommendations for improving an SSH server's [security](/@harrisonqian/awesome/wiki/security/security) posture. ### Firewall appliances or distributions See also [Wikipedia: List of router and firewall distributions](https://en.wikipedia.org/wiki/List_of_router_and_firewall_distributions). - [IPFire](https://www.ipfire.org/) - Hardened GNU/Linux based router and firewall distribution forked from IPCop. - [OPNsense](https://opnsense.org/) - Hardened FreeBSD based firewall and routing platform forked from pfSense. - [pfSense](https://www.pfsense.org/) - FreeBSD firewall and router distribution forked from m0n0wall. ## Operating System distributions - [Computer Aided Investigative Environment (CAINE)](https://caine-live.net/) - Italian GNU/Linux live distribution that pre-packages numerous digital forensics and evidence collection tools. - [Security Onion](https://securityonionsolutions.com/) - Free and open source GNU/Linux distribution for intrusion detection, enterprise [security](/@harrisonqian/awesome/wiki/security/security) monitoring, and log management. - [Qubes OS](https://qubes-os.org/) - Desktop environment built atop the Xen hypervisor project that runs each end-user program in its own virtual machine intended to provide strict [security](/@harrisonqian/awesome/wiki/security/security) controls to constrain the reach of any successful malware exploit. ## Phishing awareness and reporting See also [awesome-pentest § Social Engineering Tools](https://github.com/fabacab/awesome-pentest#social-engineering-tools). - [CertSpotter](https://github.com/SSLMate/certspotter) - Certificate Transparency log monitor from SSLMate that alerts you when a SSL/TLS certificate is issued for one of your domains. - [Gophish](https://getgophish.com/) - Powerful, open-source phishing framework that makes it easy to test your organization's exposure to phishing. - [King Phisher](https://github.com/securestate/king-phisher) - Tool for [testing](/@harrisonqian/awesome/wiki/testing/testing) and promoting user awareness by simulating real world phishing attacks. - [NotifySecurity](https://github.com/certsocietegenerale/NotifySecurity) - Outlook add-in used to help your users to report suspicious e-mails to [security](/@harrisonqian/awesome/wiki/security/security) teams. - [Phishing Intelligence Engine (PIE)](https://github.com/LogRhythm-Labs/PIE) - Framework that will assist with the detection and response to phishing attacks. - [Swordphish](https://github.com/certsocietegenerale/swordphish-awareness) - Platform allowing to create and manage (fake) phishing campaigns intended to train people in identifying suspicious mails. - [mailspoof](https://github.com/serain/mailspoof) - Scans SPF and DMARC records for issues that could allow email spoofing. - [phishing_catcher](https://github.com/x0rz/phishing_catcher) - Configurable script to watch for issuances of suspicious TLS [certificates](/@harrisonqian/awesome/wiki/learn/certificates) by domain name in the Certificate Transparency Log (CTL) using the [CertStream](https://certstream.calidog.io/) service. ## Preparedness training and wargaming (Also known as *adversary emulation*, *threat simulation*, or similar.) - [APTSimulator](https://github.com/NextronSystems/APTSimulator) - Toolset to make a system look as if it was the victim of an APT attack. - [Atomic Red Team](https://atomicredteam.io/) - Library of simple, automatable tests to execute for [testing](/@harrisonqian/awesome/wiki/testing/testing) [security](/@harrisonqian/awesome/wiki/security/security) controls. - [BadBlood](https://www.secframe.com/badblood/) - Fills a test (non-production) [Windows](/@harrisonqian/awesome/wiki/platforms/windows) Domain with data that enables [security](/@harrisonqian/awesome/wiki/security/security) analysts and engineers to practice using tools to gain an understanding and prescribe to securing Active Directory. - [Caldera](https://caldera.mitre.org/) - Scalable, automated, and extensible adversary emulation platform developed by MITRE. - [Drool](https://www.dns-oarc.net/tools/drool) - Replay DNS traffic from packet capture files and send it to a specified server, such as for simulating DDoS attacks on the DNS and measuring normal DNS querying. - [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire) - Modular, menu-driven, [cross-platform](/@harrisonqian/awesome/wiki/platforms/cross-platform) tool for building repeatable, time-delayed, distributed [security](/@harrisonqian/awesome/wiki/security/security) events for Blue Team drills and sensor/alert mapping. - [Infection Monkey](https://www.guardicore.com/infectionmonkey/) - Open-source breach and attack simulation (BAS) platform that helps you validate existing controls and identify how attackers might exploit your current network [security](/@harrisonqian/awesome/wiki/security/security) gaps. - [Metta](https://github.com/uber-common/metta) - Automated information [security](/@harrisonqian/awesome/wiki/security/security) preparedness tool to do adversarial simulation. - [Network Flight Simulator (`flightsim`)](https://github.com/alphasoc/flightsim) - Utility to generate malicious network traffic and help [security](/@harrisonqian/awesome/wiki/security/security) teams evaluate security controls and audit their network visibility. - [RedHunt OS](https://github.com/redhuntlabs/RedHunt-OS) - Ubuntu-based Open Virtual Appliance (`.ova`) preconfigured with several threat emulation tools as well as a defender's toolkit. - [Stratus Red Team](https://stratus-red-team.cloud/) - Emulate offensive attack techniques in a granular and self-contained manner against a cloud environment; think "Atomic Red Team™ for the cloud." - [tcpreplay](https://tcpreplay.appneta.com/) - Suite of free Open Source utilities for editing and replaying previously captured network traffic originally designed to replay malicious traffic patterns to Intrusion Detection/Prevention Systems. ### Post-engagement analysis and reporting - [RedEye](https://cisagov.[github](/@harrisonqian/awesome/wiki/development-environment/github).io/RedEye/) - Analytic tool to assist both Red and Blue teams with visualizing and reporting command and control activities, replay and demonstrate attack paths, and more clearly communicate remediation recommendations to stakeholders. ## Security configurations (Also known as *secure-by-default baselines* and *implemented best practices*.) - [Bunkerized-nginx](https://github.com/bunkerity/bunkerized-nginx) - [Docker](/@harrisonqian/awesome/wiki/back-end-development/docker) image of an [NginX](/@harrisonqian/awesome/wiki/back-end-development/nginx) configuration and scripts implementing many defensive techniques for Web sites. ## Security monitoring - [Crossfeed](https://docs.crossfeed.cyber.dhs.gov/) - Continuously enumerates and monitors an organization’s public-facing attack surface in order to discover assets and flag potential [security](/@harrisonqian/awesome/wiki/security/security) flaws. - [Starbase](https://github.com/JupiterOne/starbase) - Collects assets and relationships from services and systems into an intuitive graph view to offer graph-based [security](/@harrisonqian/awesome/wiki/security/security) analysis for everyone. ### Endpoint Detection and Response (EDR) - [Wazuh](https://wazuh.com/) - Open source, multiplatform agent-based [security](/@harrisonqian/awesome/wiki/security/security) monitoring based on a fork of OSSEC HIDS. ### Network Security Monitoring (NSM) See also [awesome-pcaptools](https://github.com/caesar0301/awesome-pcaptools). - [Arkime](https://github.com/arkime/arkime) - Augments your current [security](/@harrisonqian/awesome/wiki/security/security) infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access. - [ChopShop](https://github.com/MITRECND/chopshop) - Framework to aid analysts in the creation and execution of pynids-based decoders and detectors of APT tradecraft. - [Maltrail](https://github.com/stamparm/maltrail) - Malicious network traffic detection system. - [OwlH](https://www.owlh.net/) - Helps manage network IDS at scale by visualizing [Suricata](/@harrisonqian/awesome/wiki/security/suricata), Zeek, and Moloch life cycles. - [Real Intelligence Threat Analysis (RITA)](https://github.com/activecm/rita) - Open source framework for network traffic analysis that ingests Zeek logs and detects beaconing, DNS tunneling, and more. - [Respounder](https://github.com/codeexpress/respounder) - Detects the presence of the Responder LLMNR/NBT-NS/MDNS poisoner on a network. - [Snort](https://snort.org/) - Widely-deployed, [Free Software](/@harrisonqian/awesome/wiki/miscellaneous/free-software) IPS capable of real-time packet analysis, traffic logging, and custom rule-based triggers. - [SpoofSpotter](https://github.com/NetSPI/SpoofSpotter) - Catch spoofed NetBIOS Name Service (NBNS) responses and alert to an email or log file. - [Stenographer](https://github.com/google/stenographer) - Full-packet-capture utility for buffering packets to disk for intrusion detection and [incident response](/@harrisonqian/awesome/wiki/security/incident-response) purposes. - [Suricata](https://suricata-ids.org/) - Free, [cross-platform](/@harrisonqian/awesome/wiki/platforms/cross-platform), IDS/IPS with on- and off-line analysis modes and deep packet inspection capabilities that is also [scriptable](/@harrisonqian/awesome/wiki/miscellaneous/scriptable) with Lua. - [Tsunami](https://github.com/google/tsunami-[security](/@harrisonqian/awesome/wiki/security/security)-scanner) - General purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence. - [VAST](https://github.com/tenzir/vast) - Free and open-source network telemetry engine for data-driven [security](/@harrisonqian/awesome/wiki/security/security) investigations. - [Wireshark](https://www.wireshark.org) - Free and open-source packet analyzer useful for network troubleshooting or forensic netflow analysis. - [Zeek](https://zeek.org/) - Powerful [network analysis](/@harrisonqian/awesome/wiki/big-data/network-analysis) framework focused on [security](/@harrisonqian/awesome/wiki/security/security) monitoring, formerly known as Bro. - [netsniff-ng](http://netsniff-ng.org/) - Free and fast GNU/Linux networking toolkit with numerous utilities such as a connection tracking tool (`flowtop`), traffic generator (`trafgen`), and autonomous system (AS) trace route utility (`astraceroute`). ### Security Information and Event Management (SIEM) - [AlienVault OSSIM](https://www.alienvault.com/open-threat-exchange/projects) - Single-server open source SIEM platform featuring asset discovery, asset inventorying, behavioral monitoring, and event correlation, driven by AlienVault Open Threat Exchange (OTX). - [Prelude SIEM OSS](https://www.prelude-siem.org/) - Open source, agentless SIEM with a long history and several commercial variants featuring [security](/@harrisonqian/awesome/wiki/security/security) event collection, normalization, and alerting from arbitrary log input and numerous popular monitoring tools. ### Service and performance monitoring See also [awesome-sysadmin#monitoring](https://github.com/n1trux/awesome-sysadmin#monitoring). - [Icinga](https://icinga.com/) - Modular redesign of Nagios with pluggable user interfaces and an expanded set of data connectors, collectors, and reporting tools. - [Locust](https://locust.io/) - Open source load [testing](/@harrisonqian/awesome/wiki/testing/testing) tool in which you can define user behaviour with [Python](/@harrisonqian/awesome/wiki/programming-languages/python) code and swarm your system with millions of simultaneous users. - [Nagios](https://nagios.org) - Popular network and service monitoring solution and reporting platform. - [OpenNMS](https://opennms.org/) - Free and feature-rich networking monitoring system supporting multiple configurations, a variety of alerting mechanisms (email, XMPP, SMS), and numerous data collection methods (SNMP, HTTP, JDBC, etc). - [osquery](https://github.com/facebook/osquery) - Operating system instrumentation framework for macOS, [Windows](/@harrisonqian/awesome/wiki/platforms/windows), and [Linux](/@harrisonqian/awesome/wiki/platforms/linux), exposing the OS as a high-performance relational [database](/@harrisonqian/awesome/wiki/databases/database) that can be queried with a SQL-like syntax. - [Zabbix](https://www.zabbix.com/) - Mature, enterprise-level platform to monitor large-scale IT environments. ### Threat hunting (Also known as *hunt teaming* and *threat detection*.) See also [awesome-threat-detection](https://github.com/0x4D31/awesome-threat-detection). - [CimSweep](https://github.com/PowerShellMafia/CimSweep) - Suite of CIM/WMI-based tools enabling remote [incident response](/@harrisonqian/awesome/wiki/security/incident-response) and hunting operations across all versions of [Windows](/@harrisonqian/awesome/wiki/platforms/windows). - [DeepBlueCLI](https://github.com/sans-blue-team/DeepBlueCLI) - [PowerShell](/@harrisonqian/awesome/wiki/development-environment/powershell) module for hunt teaming via [Windows](/@harrisonqian/awesome/wiki/platforms/windows) Event logs. - [GRR Rapid Response](https://github.com/google/grr) - [Incident response](/@harrisonqian/awesome/wiki/security/incident-response) framework focused on remote live forensics consisting of a [Python](/@harrisonqian/awesome/wiki/programming-languages/python) agent installed on assets and Python-based server infrastructure enabling analysts to quickly triage attacks and perform analysis remotely. - [Hunting ELK (HELK)](https://github.com/Cyb3rWard0g/HELK) - All-in-one [Free Software](/@harrisonqian/awesome/wiki/miscellaneous/free-software) threat hunting stack based on Elasticsearch, Logstash, Kafka, and Kibana with various built-in integrations for [analytics](/@harrisonqian/awesome/wiki/miscellaneous/analytics) including [Jupyter](/@harrisonqian/awesome/wiki/miscellaneous/jupyter) Notebook. - [Logging Made Easy (LME)](https://www.cisa.gov/resources-tools/services/logging-made-easy) - Free and open logging and protective monitoring solution serving. - [MozDef](https://github.com/mozilla/MozDef) - Automate the [security](/@harrisonqian/awesome/wiki/security/security) incident handling process and facilitate the real-time activities of incident handlers. - [PSHunt](https://github.com/Infocyte/PSHunt) - [PowerShell](/@harrisonqian/awesome/wiki/development-environment/powershell) module designed to scan remote endpoints for indicators of compromise or survey them for more comprehensive information related to state of those systems. - [PSRecon](https://github.com/gfoss/PSRecon) - PSHunt-like tool for analyzing remote [Windows](/@harrisonqian/awesome/wiki/platforms/windows) systems that also produces a self-contained HTML report of its findings. - [PowerForensics](https://github.com/Invoke-IR/PowerForensics) - All in one [PowerShell](/@harrisonqian/awesome/wiki/development-environment/powershell)-based platform to perform live hard disk forensic analysis. - [Redline](https://www.fireeye.com/services/freeware/redline.html) - Freeware endpoint auditing and analysis tool that provides host-based investigative capabilities, offered by FireEye, Inc. - [rastrea2r](https://github.com/rastrea2r/rastrea2r) - Multi-platform tool for triaging suspected IOCs on many endpoints simultaneously and that integrates with antivirus consoles. ## Threat intelligence See also [awesome-threat-intelligence](https://github.com/hslatman/awesome-threat-intelligence). - [AttackerKB](https://attackerkb.com/) - Free and public crowdsourced vulnerability assessment platform to help prioritize high-risk patch application and combat vulnerability fatigue. - [DATA](https://github.com/hadojae/DATA) - Credential phish analysis and automation tool that can accept suspected phishing URLs directly or trigger on observed network traffic containing such a URL. - [Forager](https://github.com/opensourcesec/Forager) - Multi-threaded threat intelligence gathering built with Python3 featuring simple text-based configuration and data storage for ease of use and data portability. - [GRASSMARLIN](https://github.com/nsacyber/GRASSMARLIN) - Provides IP network situational awareness of industrial control systems (ICS) and Supervisory Control and Data Acquisition (SCADA) by passively mapping, accounting for, and reporting on your ICS/SCADA network topology and endpoints. - [MLSec Combine](https://github.com/mlsecproject/combine) - Gather and combine multiple threat intelligence feed sources into one customizable, standardized CSV-based format. - [Malware Information Sharing Platform and Threat Sharing (MISP)](https://misp-project.org/) - Open source software solution for collecting, storing, distributing and sharing cyber [security](/@harrisonqian/awesome/wiki/security/security) indicators. - [Open Source Vulnerabilities (OSV)](https://osv.dev/) - Vulnerability [database](/@harrisonqian/awesome/wiki/databases/database) and triage infrastructure for open source projects aimed at helping both [open source maintainers](/@harrisonqian/awesome/wiki/miscellaneous/open-source-maintainers) and consumers of open source. - [Sigma](https://github.com/Neo23x0/sigma) - Generic signature format for SIEM systems, offering an open signature format that allows you to describe relevant log events in a straightforward manner. - [Threat Bus](https://github.com/tenzir/threatbus) - Threat intelligence dissemination layer to connect [security](/@harrisonqian/awesome/wiki/security/security) tools through a distributed publish/subscribe message broker. - [ThreatIngestor](https://github.com/InQuest/ThreatIngestor) - Extendable tool to extract and aggregate IOCs from threat feeds including Twitter, RSS feeds, or other sources. - [Unfetter](https://nsacyber.[github](/@harrisonqian/awesome/wiki/development-environment/github).io/unfetter/) - Identifies defensive gaps in [security](/@harrisonqian/awesome/wiki/security/security) posture by leveraging Mitre's ATT&CK framework. - [Viper](https://github.com/viper-framework/viper) - Binary analysis and management framework enabling easy organization of malware and exploit samples. - [YARA](https://github.com/VirusTotal/yara) - Tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples, described as "the pattern matching swiss army knife" for file patterns and signatures. ### Fingerprinting - [HASSH](https://github.com/salesforce/hassh) - Network fingerprinting standard which can be used to identify specific client and server SSH implementations. - [JA3](https://ja3er.com/) - Extracts SSL/TLS handshake settings for fingerprinting and communicating about a given TLS implementation. ### Threat signature packages and collections - [ESET's Malware IoCs](https://github.com/eset/malware-ioc) - Indicators of Compromises (IOCs) derived from ESET's various investigations. - [FireEye's Red Team Tool Countermeasures](https://github.com/fireeye/red_team_tool_countermeasures) - Collection of Snort and YARA rules to detect attacks carried out with FireEye's own Red Team tools, first released after FireEye disclosed a breach in December 2020. - [FireEye's Sunburst Countermeasures](https://github.com/fireeye/sunburst_countermeasures) - Collection of IoC in various languages for detecting backdoored SolarWinds Orion NMS activities and related vulnerabilities. - [YARA Rules](https://github.com/Yara-Rules/rules) - Project covering the need for IT [security](/@harrisonqian/awesome/wiki/security/security) researchers to have a single repository where different Yara signatures are compiled, classified and kept as up to date as possible. ## Tor Onion service defenses See also [awesome-tor](https://github.com/ajvb/awesome-tor). - [OnionBalance](https://onionbalance.readthedocs.io/) - Provides load-balancing while also making Onion services more resilient and reliable by eliminating single points-of-failure. - [Vanguards](https://github.com/mikeperry-tor/vanguards) - Version 3 Onion service guard discovery attack mitigation script (intended for eventual inclusion in Tor core). ## Transport-layer defenses - [Certbot](https://certbot.eff.org/) - Free tool to automate the issuance and renewal of TLS [certificates](/@harrisonqian/awesome/wiki/learn/certificates) from the [LetsEncrypt Root CA](https://letsencrypt.org/) with plugins that configure various Web and e-mail server software. - [MITMEngine](https://github.com/cloudflare/mitmengine) - Golang library for server-side detection of TLS interception events. - [Tor](https://torproject.org/) - Censorship circumvention and anonymizing overlay network providing distributed, cryptographically verified name services (`.onion` domains) to enhance publisher privacy and service availability. ### Overlay and Virtual Private Networks (VPNs) - [Firezone](https://www.firezone.dev/) - Self-hosted VPN server built on WireGuard that supports MFA and SSO. - [Headscale](https://github.com/juanfont/headscale) - Open source, self-hosted implementation of the Tailscale control server. - [IPsec VPN Server Auto Setup Scripts](https://github.com/hwdsl2/setup-ipsec-vpn) - Scripts to build your own IPsec VPN server, with IPsec/L2TP, Cisco IPsec and IKEv2. - [Innernet](https://github.com/tonarino/innernet) - [Free Software](/@harrisonqian/awesome/wiki/miscellaneous/free-software) private network system that uses WireGuard under the hood, made to be self-hosted. - [Nebula](https://github.com/slackhq/nebula) - Completely open source and self-hosted, scalable overlay networking tool with a focus on performance, simplicity, and [security](/@harrisonqian/awesome/wiki/security/security), inspired by tinc. - [OpenVPN](https://openvpn.net/) - Longstanding [Free Software](/@harrisonqian/awesome/wiki/miscellaneous/free-software) traditional SSL/TLS-based virtual private network. - [OpenZITI](https://openziti.[github](/@harrisonqian/awesome/wiki/development-environment/github).io/) - Open source initiative focused on bringing Zero Trust to any application via an overlay network, tunelling applications, and numerous SDKs. - [Tailscale](https://tailscale.com/) - Managed freemium mesh VPN service built on top of WireGuard. - [WireGuard](https://www.wireguard.com/) - Extremely simple yet fast and modern VPN that utilizes state-of-the-art [cryptography](/@harrisonqian/awesome/wiki/computer-science/cryptography). - [tinc](https://tinc-vpn.org/) - [Free Software](/@harrisonqian/awesome/wiki/miscellaneous/free-software) mesh VPN implemented entirely in userspace that supports expandable network space, bridged ethernet segments, and more. ## macOS-based defenses See also [drduh/macOS-Security-and-Privacy-Guide](https://github.com/drduh/macOS-Security-and-Privacy-Guide). - [BlockBlock](https://objective-see.com/products/blockblock.html) - Monitors common persistence locations and alerts whenever a persistent component is added, which helps to detect and prevent malware installation. - [LuLu](https://objective-see.com/products/lulu.html) - Free macOS firewall. - [Santa](https://github.com/google/santa) - Keep track of binaries that are naughty or nice in an allow/deny-listing system for macOS. - [Stronghold](https://github.com/alichtman/stronghold) - Easily configure macOS [security](/@harrisonqian/awesome/wiki/security/security) settings from the terminal. - [macOS Fortress](https://github.com/essandess/macOS-Fortress) - Automated configuration of kernel-level, OS-level, and client-level [security](/@harrisonqian/awesome/wiki/security/security) features including privatizing proxying and anti-virus scanning for macOS. ## Windows-based defenses See also [awesome-windows#security](https://github.com/Awesome-Windows/Awesome#security) and [awesome-windows-domain-hardening](https://github.com/PaulSec/awesome-windows-domain-hardening). - [CobaltStrikeScan](https://github.com/Apr4h/CobaltStrikeScan) - Scan files or process memory for Cobalt Strike beacons and parse their configuration. - [HardenTools](https://github.com/securitywithoutborders/hardentools) - Utility that disables a number of risky [Windows](/@harrisonqian/awesome/wiki/platforms/windows) features. - [NotRuler](https://github.com/sensepost/notruler) - Detect both client-side rules and VBScript enabled forms used by the [Ruler](https://github.com/sensepost/ruler) attack tool when attempting to compromise a Microsoft Exchange server. - [Sandboxie](https://www.sandboxie.com/) - Free and open source general purpose [Windows](/@harrisonqian/awesome/wiki/platforms/windows) application sandboxing utility. - [Sigcheck](https://docs.microsoft.com/en-us/sysinternals/downloads/sigcheck) - Audit a [Windows](/@harrisonqian/awesome/wiki/platforms/windows) host's root certificate store against Microsoft's [Certificate Trust List (CTL)](https://docs.microsoft.com/en-us/windows/desktop/SecCrypto/certificate-trust-list-overview). - [Sticky Keys Slayer](https://github.com/linuz/Sticky-Keys-Slayer) - Establishes a [Windows](/@harrisonqian/awesome/wiki/platforms/windows) RDP session from a list of hostnames and scans for accessibility tools backdoors, alerting if one is discovered. - [Windows Secure Host Baseline](https://github.com/nsacyber/Windows-Secure-Host-Baseline) - Group Policy objects, compliance checks, and configuration tools that provide an automated and flexible approach for securely deploying and maintaining the latest releases of [Windows](/@harrisonqian/awesome/wiki/platforms/windows) 10. - [WMI Monitor](https://github.com/realparisi/WMI_Monitor) - Log newly created WMI consumers and processes to the [Windows](/@harrisonqian/awesome/wiki/platforms/windows) Application event log. ### Active Directory - [Active Directory Control Paths](https://github.com/ANSSI-FR/AD-control-paths) - Visualize and graph Active Directory permission configs ("control relations") to audit questions such as "Who can read the CEO's email?" and similar. - [PingCastle](https://www.pingcastle.com/) - Active Directory vulnerability detection and reporting tool. - [PlumHound](https://github.com/PlumHound/PlumHound) - More effectively use BloodHoundAD in continual [security](/@harrisonqian/awesome/wiki/security/security) life-cycles by utilizing its pathfinding engine to identify Active Directory security vulnerabilities. ## License [](https://creativecommons.org/licenses/by/4.0/) This work is licensed under a [Creative Commons Attribution 4.0 International License](https://creativecommons.org/licenses/by/4.0/).