Statistics for topic dfir

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具

A curated list of tools for incident response

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Automate the creation of a lab environment complete with security tooling and logging best practices

Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.

Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具

Dumps all of the Key/Value pairs from a LevelDB database

Provides various Windows Server Active Directory (AD) security-focused reports.

MacOS forensic acquisition made simple

Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

A curated list of tools for incident response

Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.

MacOS forensic acquisition made simple

Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具

Extracted Yara rules from Windows Defender mpavbase and mpasbase

LOKI2 - Simple IOC and YARA Scanner

Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.

Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具

MacOS forensic acquisition made simple

A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.

KQL Queries. Microsoft Defender, Microsoft Sentinel

Dumps all of the Key/Value pairs from a LevelDB database

Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具

A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.

LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...

FJTA (Forensic Journal Timeline Analyzer) is a tool that analyzes Linux filesystem (EXT4, XFS) journals (not systemd-journald), generates timelines, and detects suspicious activities.

Windows Administrator level Implant.

IntelOwl: manage your Threat Intelligence at scale

A curated list of tools for incident response

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Awesome Security lists for SOC/CERT/CTI

Harness the power of Splunk for your investigations

PowerShell script designed to help Incident Responders collect forensic evidence from local and remote Windows devices.

MacOS forensic acquisition made simple

LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...

Awesome Security lists for SOC/CERT/CTI