Skip to content

@FalconForceTeam FalconForce

Change the repository type filter

All

    Repositories list

    14 repositories

    • KQLAnalyzer

      Public
      REST server that can analyze Kusto KQL queries against the Sentinel and Microsoft 365 Defender schemas.
      C#
      •9•32•0•0•Updated Jan 24, 2025Jan 24, 2025

    • reply-url-brute

      Public
      Tool to enumerate unregistered reply URLs for single and multitenant apps in Azure
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •2•11•0•0•Updated Jan 23, 2025Jan 23, 2025

    • bof-winrm-client

      Public
      C++
      •
      BSD 3-Clause "New" or "Revised" License
      •14•89•0•0•Updated Jan 23, 2025Jan 23, 2025

    • bof-winrm-plugin-jump

      Public
      C++
      •
      BSD 3-Clause "New" or "Revised" License
      •2•18•0•0•Updated Jan 23, 2025Jan 23, 2025

    • FalconFriday

      Public
      Hunting queries and detections
      sentinelhuntingblueteampurpleteamkqldefender-atpdefender-for-endpoint
      BSD 3-Clause "New" or "Revised" License
      •88•749•1•0•Updated Jan 17, 2025Jan 17, 2025

    • FalconHound

      Public
      FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool.
      Go
      •
      BSD 3-Clause "New" or "Revised" License
      •52•774•1•1•Updated Dec 30, 2024Dec 30, 2024

    • SOAPHound

      Public
      SOAPHound is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADWS) protocol.
      C#
      •
      GNU General Public License v3.0
      •73•706•4•1•Updated Feb 3, 2024Feb 3, 2024

    • AzureHoundAutoCollect

      Public
      Some plumbing to automate the collection of AzureHound
      Shell
      •2•3•0•0•Updated Jul 24, 2023Jul 24, 2023

    • ParrotForce

      Public
      Azure playbook for automatic evidence collection
      automationazureresponse
      5•8•0•0•Updated Jul 3, 2023Jul 3, 2023

    • FalconForge

      Public
      This repository is used by FalconForce to release parts of the internal tools used for maintaining, validating and automatically deploying a repository of use-cases for the Sentinel and Microsoft 365 Defender products.
      Python
      •9•15•0•0•Updated Mar 10, 2023Mar 10, 2023

    • SysWhispers2BOF

      Public
      Script to use SysWhispers2 direct system calls from Cobalt Strike BOFs
      Python
      •19•120•0•1•Updated May 24, 2022May 24, 2022

    • ADExplorerSnapshot.py

      Public
      ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.
      Python
      •124•2•0•0•Updated Apr 6, 2022Apr 6, 2022

    • Azure-Sentinel

      Public
      Cloud-native SIEM for intelligent security analytics for your entire enterprise.
      Jupyter Notebook
      •
      MIT License
      •3.1k•9•0•0•Updated Mar 11, 2022Mar 11, 2022

    • BOF2shellcode

      Public
      POC tool to convert CobaltStrike BOF files to raw shellcode
      C
      •
      Other
      •28•184•1•0•Updated Nov 5, 2021Nov 5, 2021