Skip to content

@FalconForceTeam FalconForce

Change the repository type filter

All

    Repositories list

    17 repositories

    • KQLAnalyzer

      Public
      REST server that can analyze Kusto KQL queries against the Sentinel and Microsoft 365 Defender schemas.
      C#
      •19•54•1•0•Updated Jul 27, 2026Jul 27, 2026

    • FalconFriday

      Public
      Hunting queries and detections
      sentinelhuntingblueteam
      sentinelhuntingblueteampurpleteamkqldefender-atpdefender-for-endpoint
      BSD 3-Clause "New" or "Revised" License
      •113•919•1•1•Updated May 7, 2026May 7, 2026

    • FalconHound

      Public
      FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in co…
      Go
      •
      BSD 3-Clause "New" or "Revised" License
      •59•826•0•1•Updated Apr 18, 2026Apr 18, 2026

    • NRT-KQL

      Public
      To create NRT rules, we needed to be certain about the KQL syntax that can and cannot be used. This led us to create our own documentation.
      GNU General Public License v3.0
      •0•0•0•0•Updated Feb 4, 2026Feb 4, 2026

    • TelemetryCollectionManager

      Public
      Manage and maintain Defender XDR custom collection configuration
      Go
      •
      BSD 3-Clause "New" or "Revised" License
      •0•39•1•0•Updated Nov 19, 2025Nov 19, 2025

    • dAWShund

      Public
      Putting a leash on naughty AWS permissions
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •10•137•0•0•Updated Sep 5, 2025Sep 5, 2025

    • reply-url-brute

      Public
      Tool to enumerate unregistered reply URLs for single and multitenant apps in Azure
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •2•15•0•0•Updated Jan 23, 2025Jan 23, 2025

    • bof-winrm-client

      Public
      C++
      •
      BSD 3-Clause "New" or "Revised" License
      •20•133•0•0•Updated Jan 23, 2025Jan 23, 2025

    • bof-winrm-plugin-jump

      Public
      C++
      •
      BSD 3-Clause "New" or "Revised" License
      •2•36•0•0•Updated Jan 23, 2025Jan 23, 2025

    • SOAPHound

      Public
      SOAPHound is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADW…
      C#
      •
      GNU General Public License v3.0
      •94•894•5•1•Updated Feb 3, 2024Feb 3, 2024

    • AzureHoundAutoCollect

      Public
      Some plumbing to automate the collection of AzureHound
      Shell
      •2•4•0•0•Updated Jul 24, 2023Jul 24, 2023

    • ParrotForce

      Public
      Azure playbook for automatic evidence collection
      automationazureresponse
      automationazureresponse
      5•12•0•0•Updated Jul 3, 2023Jul 3, 2023

    • FalconForge

      Public
      This repository is used by FalconForce to release parts of the internal tools used for maintaining, validating and automatically deploying a repository of use-c…
      Python
      •10•17•0•0•Updated Mar 10, 2023Mar 10, 2023

    • SysWhispers2BOF

      Public
      Script to use SysWhispers2 direct system calls from Cobalt Strike BOFs
      Python
      •16•125•0•1•Updated May 24, 2022May 24, 2022

    • ADExplorerSnapshot.py

      Public
      ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.
      Python
      •150•3•0•0•Updated Apr 6, 2022Apr 6, 2022

    • Azure-Sentinel

      Public
      Cloud-native SIEM for intelligent security analytics for your entire enterprise.
      Jupyter Notebook
      •
      MIT License
      •3.8k•10•0•0•Updated Mar 11, 2022Mar 11, 2022

    • BOF2shellcode

      Public
      POC tool to convert CobaltStrike BOF files to raw shellcode
      C
      •
      Other
      •27•220•1•0•Updated Nov 5, 2021Nov 5, 2021
    ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.