Skip to content

@invictus-ir Invictus Incident Response

Change the repository type filter

All

    Repositories list

    19 repositories

    • Microsoft-Extractor-Suite

      Public
      A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
      microsoftmicrosoft365
      microsoftmicrosoft365
      PowerShell
      •
      GNU General Public License v2.0
      •119•830•0•1•Updated Jun 29, 2026Jun 29, 2026

    • IOCs

      Public
      Invictus Threat Intelligence: IOCs and TTPs from blogs, research and more
      1•30•0•0•Updated Mar 31, 2026Mar 31, 2026

    • ALFA

      Public
      ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform auto…
      Python
      •
      MIT License
      •29•183•0•6•Updated Mar 2, 2026Mar 2, 2026

    • KubeForenSys

      Public
      A Kubernetes Forensic Collection Framework for Azure Kubernetes Service
      Python
      •
      GNU General Public License v2.0
      •4•43•0•0•Updated Feb 9, 2026Feb 9, 2026

    • Invictus-Nebius

      Public
      A Python script to acquire logs using the Nebius CLI
      Python
      •
      MIT License
      •0•0•0•0•Updated Jan 26, 2026Jan 26, 2026

    • aws-cheatsheet

      Public
      A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.
      MIT License
      •18•84•0•0•Updated Jan 6, 2026Jan 6, 2026

    • Invictus-AWS

      Public
      A tool for AWS incident response, that allows for enumeration, acquisition and analysis of data from AWS environments for the purpose of incident response.
      Python
      •
      MIT License
      •19•204•0•2•Updated Jan 6, 2026Jan 6, 2026

    • talks

      Public
      An overview of our talks at security conferences
      1•8•0•0•Updated Sep 15, 2025Sep 15, 2025

    • entra-apps

      Public
      List of Microsoft Apps in Entra ID
      3•10•1•0•Updated Jan 3, 2025Jan 3, 2025

    • Invictus-training

      Public
      Repository with supporting materials for Invictus Academy/Training
      Shell
      •6•44•0•0•Updated Jan 3, 2025Jan 3, 2025

    • Blue-team-app-Office-365-and-Azure

      Public
      GNU General Public License v3.0
      •12•72•0•0•Updated Oct 21, 2024Oct 21, 2024

    • kql_queries

      Public
      KQL queries for Incident Response
      8•15•0•0•Updated Oct 31, 2023Oct 31, 2023

    • aws_dataset

      Public
      A dataset with CloudTrail events from an attack simulation using Stratus.
      MIT License
      •7•28•0•0•Updated Jul 12, 2023Jul 12, 2023

    • Sigma-AWS

      Public
      This repository contains the research and components of our research into using Sigma for AWS Incident Response.
      Python
      •
      MIT License
      •10•35•0•1•Updated Jul 12, 2023Jul 12, 2023

    • Email-Forwarding-Rules

      Public
      A mind map of email forwarding rule evidence in Microsoft 365
      0•3•0•0•Updated Feb 20, 2023Feb 20, 2023

    • gws_dataset

      Public
      Google Workspace Audit logs containing several attacks
      MIT License
      •2•9•0•0•Updated Aug 15, 2022Aug 15, 2022

    • macOS

      Public
      Repository for macOS related security research
      1•8•0•0•Updated Jun 7, 2022Jun 7, 2022

    • cobaltstrike

      Public
      Collection of resources related to Cobalt Strike investigations
      2•9•0•0•Updated Jun 7, 2022Jun 7, 2022

    • o365_dataset

      Public
      A dataset containing Office 365 Unified Audit Logs for security research and detection
      7•62•1•0•Updated Jun 7, 2022Jun 7, 2022
    ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.