add tools

mthcht · Dec 12, 2023 · 58f0c8c · 58f0c8c
1 parent fa8b39e
commit 58f0c8c
Show file tree

Hide file tree

Showing 938 changed files with 49,258 additions and 45,510 deletions.
diff --git a/greyware_tool_keyword.csv b/greyware_tool_keyword.csv
diff --git a/offensive_tool_keyword.csv b/offensive_tool_keyword.csv
diff --git a/only_keywords.txt b/only_keywords.txt
diff --git a/only_keywords_regex.txt b/only_keywords_regex.txt
diff --git a/release_notes/Release_20231213.csv b/release_notes/Release_20231213.csv
diff --git a/signature_keyword.csv b/signature_keyword.csv
@@ -73,6 +73,7 @@
 "*TrojanSpy:MSIL/JSSLoader*","signature_keyword","Antivirus Signature","antivirus signatures","N/A","N/A","N/A","N/A","Malware","N/A","1","0","N/A","10","10","N/A","N/A","N/A","N/A"
 "*TrojanSpy:MSIL/JSSLoader*","signature_keyword","Antivirus Signature","Antiviurs signature_keyword","N/A","N/A","N/A","N/A","Malware","N/A","1","0","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
 "*VirTool:MSIL*","signature_keyword","Antivirus Signature","AV signature for exploitation tools","N/A","N/A","N/A","N/A","Exploitation tools","N/A","1","0","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
+"*VirTool:PowerShell/Dipadz.*","signature_keyword","Antivirus Signature","AV signature for exploitation tools","N/A","N/A","N/A","N/A","Exploitation tools","N/A","1","0","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
 "*VirTool:Win32*","signature_keyword","Antivirus Signature","AV signature for exploitation tools","N/A","N/A","N/A","N/A","Exploitation tools","N/A","1","0","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
 "*VirTool:Win32/RemoteExec*","signature_keyword","Antivirus Signature","AV signature often associated with C2 communications (cobaltstrike for example)","N/A","N/A","N/A","N/A","Exploitation tools","N/A","1","0","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
 "*Win32.Trojan*","signature_keyword","Antivirus Signature","Antiviurs signature_keyword","N/A","N/A","N/A","N/A","Malware","N/A","1","0","N/A","N/A","N/A","N/A","N/A","N/A","N/A"

diff --git a/threathunting-keywords.csv b/threathunting-keywords.csv
diff --git a/tools/A-C/ACLight.csv b/tools/A-C/ACLight.csv
diff --git a/tools/A-C/ADACLScanner.csv b/tools/A-C/ADACLScanner.csv
diff --git a/tools/A-C/ADCSKiller.csv b/tools/A-C/ADCSKiller.csv
@@ -1,5 +1,5 @@
 "keyword","metadata_keyword_type","metadata_tool","metadata_description","metadata_tool_techniques","metadata_tool_tactics","metadata_malwares_name","metadata_groups_name","metadata_category","metadata_link","metadata_enable_endpoint_detection","metadata_enable_proxy_detection","metadata_comment","metadata_severity_score","metadata_popularity_score","metadata_github_stars","metadata_github_forks","metadata_github_updated_at","metadata_github_created_at"
-"*/ADCSKiller*","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","650","62","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
-"*adcskiller.py*","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","650","62","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
-"*ly4k/Certipy*","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","650","62","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
-"*p0dalirius/Coercer*","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","650","62","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
+"*/ADCSKiller*","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","657","63","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
+"*adcskiller.py*","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","657","63","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
+"*ly4k/Certipy*","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","657","63","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
+"*p0dalirius/Coercer*","offensive_tool_keyword","ADCSKiller","ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services (ADCS) vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure","T1552.004 - T1003.003 - T1114.002","TA0006 - TA0003 - TA0005","N/A","N/A","Exploitation tools","https://github.com/grimlockx/ADCSKiller","1","1","N/A","N/A","7","657","63","2023-05-19T17:36:37Z","2023-05-19T06:51:41Z"
diff --git a/tools/A-C/ADCSPwn.csv b/tools/A-C/ADCSPwn.csv
@@ -1,9 +1,9 @@
 "keyword","metadata_keyword_type","metadata_tool","metadata_description","metadata_tool_techniques","metadata_tool_tactics","metadata_malwares_name","metadata_groups_name","metadata_category","metadata_link","metadata_enable_endpoint_detection","metadata_enable_proxy_detection","metadata_comment","metadata_severity_score","metadata_popularity_score","metadata_github_stars","metadata_github_forks","metadata_github_updated_at","metadata_github_created_at"
-"*.exe --adcs * --remote *","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","0","N/A","10","8","766","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
-"*/ADCSPwn.git*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","766","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
-"*\ADCSPwn*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","0","N/A","10","8","766","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
-"*ADCSPwn.csproj*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","766","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
-"*ADCSPwn.exe*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","766","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
-"*ADCSPwn.sln*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","766","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
-"*ADCSPwn-master*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","766","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
-"*bats3c/ADCSPwn*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","766","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
+"*.exe --adcs * --remote *","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","0","N/A","10","8","764","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
+"*/ADCSPwn.git*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","764","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
+"*\ADCSPwn*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","0","N/A","10","8","764","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
+"*ADCSPwn.csproj*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","764","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
+"*ADCSPwn.exe*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","764","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
+"*ADCSPwn.sln*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","764","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
+"*ADCSPwn-master*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","764","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
+"*bats3c/ADCSPwn*","offensive_tool_keyword","ADCSPwn","A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service","T1550.002 - T1078.003 - T1110.003","TA0004 - TA0006","N/A","N/A","Privilege Escalation","https://github.com/bats3c/ADCSPwn","1","1","N/A","10","8","764","122","2023-03-20T20:30:40Z","2021-07-30T15:04:41Z"
diff --git a/tools/A-C/ADExplorerSnapshot.py.csv b/tools/A-C/ADExplorerSnapshot.py.csv
@@ -1,3 +1,3 @@
 "keyword","metadata_keyword_type","metadata_tool","metadata_description","metadata_tool_techniques","metadata_tool_tactics","metadata_malwares_name","metadata_groups_name","metadata_category","metadata_link","metadata_enable_endpoint_detection","metadata_enable_proxy_detection","metadata_comment","metadata_severity_score","metadata_popularity_score","metadata_github_stars","metadata_github_forks","metadata_github_updated_at","metadata_github_created_at"
-"*ADExplorerSnapshot.py*","offensive_tool_keyword","ADExplorerSnapshot.py","ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound and also supports full-object dumping to NDJSON.","T1595 T1590 T1591","N/A","N/A","N/A","Reconnaissance","https://github.com/c3c/ADExplorerSnapshot.py","1","1","N/A","N/A","8","713","91","2023-08-24T11:58:03Z","2021-12-22T14:42:23Z"
-"*ADExplorerSnapshot.py.git*","offensive_tool_keyword","ADExplorerSnapshot.py","ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound and also supports full-object dumping to NDJSON.","T1595 T1590 T1591","N/A","N/A","N/A","Reconnaissance","https://github.com/c3c/ADExplorerSnapshot.py","1","1","N/A","N/A","8","713","91","2023-08-24T11:58:03Z","2021-12-22T14:42:23Z"
+"*ADExplorerSnapshot.py*","offensive_tool_keyword","ADExplorerSnapshot.py","ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound and also supports full-object dumping to NDJSON.","T1595 T1590 T1591","N/A","N/A","N/A","Reconnaissance","https://github.com/c3c/ADExplorerSnapshot.py","1","1","N/A","N/A","8","715","92","2023-08-24T11:58:03Z","2021-12-22T14:42:23Z"
+"*ADExplorerSnapshot.py.git*","offensive_tool_keyword","ADExplorerSnapshot.py","ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound and also supports full-object dumping to NDJSON.","T1595 T1590 T1591","N/A","N/A","N/A","Reconnaissance","https://github.com/c3c/ADExplorerSnapshot.py","1","1","N/A","N/A","8","715","92","2023-08-24T11:58:03Z","2021-12-22T14:42:23Z"
diff --git a/tools/A-C/ADFSpoof.csv b/tools/A-C/ADFSpoof.csv
@@ -1,7 +1,7 @@
 "keyword","metadata_keyword_type","metadata_tool","metadata_description","metadata_tool_techniques","metadata_tool_tactics","metadata_malwares_name","metadata_groups_name","metadata_category","metadata_link","metadata_enable_endpoint_detection","metadata_enable_proxy_detection","metadata_comment","metadata_severity_score","metadata_popularity_score","metadata_github_stars","metadata_github_forks","metadata_github_updated_at","metadata_github_created_at"
-"* ADFSpoof.py*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","0","N/A","10","4","318","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
-"* -b *.bin *.bin dump*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","0","N/A","10","4","318","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
-"*/ADFSpoof.py*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","1","N/A","10","4","318","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
-"*\ADFSpoof.py*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","0","N/A","10","4","318","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
-"*ADFSpoof-master*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","1","N/A","10","4","318","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
-"*EncryptedPfx.py*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","0","N/A","10","4","318","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
+"* ADFSpoof.py*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","0","N/A","10","4","321","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
+"* -b *.bin *.bin dump*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","0","N/A","10","4","321","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
+"*/ADFSpoof.py*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","1","N/A","10","4","321","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
+"*\ADFSpoof.py*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","0","N/A","10","4","321","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
+"*ADFSpoof-master*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","1","N/A","10","4","321","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"
+"*EncryptedPfx.py*","offensive_tool_keyword","ADFSpoof","A python tool to forge AD FS security tokens.","T1600 - T1600.001 - T1552 - T1552.004","TA0006 - TA0001","N/A","N/A","Sniffing & Spoofing","https://github.com/mandiant/ADFSpoof","1","0","N/A","10","4","321","54","2023-10-21T14:28:31Z","2019-03-20T22:30:58Z"