Trending repositories for topic dfir

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Rapidly Search and Hunt through Windows Forensic Artefacts

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Extracted Yara rules from Windows Defender mpavbase and mpasbase

Awesome list of keywords and artifacts for Threat Hunting sessions

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

Awesome Security lists for SOC/CERT/CTI

Your Everyday Threat Intelligence

A list of cyber-chef recipes and curated links

Documentation and scripts to properly enable Windows event logs.

TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Defanged Indicator of Compromise (IOC) Extractor.

The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts...

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

Digital Forensics Investigation Platform

A collection of resources for Threat Hunters

Educational, CTF-styled labs for individuals interested in Memory Forensics

Extracted Yara rules from Windows Defender mpavbase and mpasbase

TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Awesome list of keywords and artifacts for Threat Hunting sessions

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

Documentation and scripts to properly enable Windows event logs.

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Awesome Security lists for SOC/CERT/CTI

Defanged Indicator of Compromise (IOC) Extractor.

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts...

Rapidly Search and Hunt through Windows Forensic Artefacts

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

Digital Forensics Investigation Platform

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

A collection of resources for Threat Hunters

Your Everyday Threat Intelligence

A list of cyber-chef recipes and curated links

Educational, CTF-styled labs for individuals interested in Memory Forensics

Extracted Yara rules from Windows Defender mpavbase and mpasbase

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Rapidly Search and Hunt through Windows Forensic Artefacts

IntelOwl: manage your Threat Intelligence at scale

A curated list of tools for incident response

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

Open Source EDR for Windows

Educational, CTF-styled labs for individuals interested in Memory Forensics

Collaborative forensic timeline analysis

Loki - Simple IOC and YARA Scanner

Documentation and scripts to properly enable Windows event logs.

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Awesome list of keywords and artifacts for Threat Hunting sessions

Automate the creation of a lab environment complete with security tooling and logging best practices

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Your Everyday Threat Intelligence

Extracted Yara rules from Windows Defender mpavbase and mpasbase

TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Documentation and scripts to properly enable Windows event logs.

Awesome list of keywords and artifacts for Threat Hunting sessions

Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Powershell module for VMWare vSphere forensics

Handbook of windows forensic artifacts across multiple Windows version with interpretation tips and some examples. Work in progress!

Signature engine for all your logs

⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes

Open Source EDR for Windows

Forensics artefact collection tool for systems running Microsoft Windows

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Awesome Security lists for SOC/CERT/CTI

Defanged Indicator of Compromise (IOC) Extractor.

Educational, CTF-styled labs for individuals interested in Memory Forensics

The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts...

Extracted Yara rules from Windows Defender mpavbase and mpasbase

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

A curated list of tools for incident response

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Rapidly Search and Hunt through Windows Forensic Artefacts

IntelOwl: manage your Threat Intelligence at scale

⭐️ A curated list of awesome forensic analysis tools and resources

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Awesome Security lists for SOC/CERT/CTI

Collaborative forensic timeline analysis

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

YARA signature and IOC database for my scanners and tools

Your Everyday Threat Intelligence

Investigate malicious Windows logon by visualizing and analyzing Windows event log

Extracted Yara rules from Windows Defender mpavbase and mpasbase

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Graphical interface for the forensic logical acquisition of Mac computers

TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.

This is a repository dedicated to the DFIR journey. Contains notes, reflections and links to tools.

Handbook of windows forensic artifacts across multiple Windows version with interpretation tips and some examples. Work in progress!

Dumps all of the Key/Value pairs from a LevelDB database

yara detection rules for hunting with the threathunting-keywords project

Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in this exciting journey and add your expertise to our collective eff...

Search Index Database Reporter

Sigma detection rules for hunting with the threathunting-keywords project

Awesome Security lists for SOC/CERT/CTI

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

(Sometimes partial) Python re-implementations of the technologies involved in reading various data sources in Chrome-esque applications.

Provides various Windows Server Active Directory (AD) security-focused reports.

Awesome list of keywords and artifacts for Threat Hunting sessions

⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

Windows Administrator level Implant.

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Collection of forensic tools

Extracted Yara rules from Windows Defender mpavbase and mpasbase

LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...

Harness the power of Splunk for your investigations

Graphical interface for the forensic logical acquisition of Mac computers

Windows Administrator level Implant.

A curated list of tools for incident response

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

IntelOwl: manage your Threat Intelligence at scale

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

⭐️ A curated list of awesome forensic analysis tools and resources

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Awesome Security lists for SOC/CERT/CTI

Rapidly Search and Hunt through Windows Forensic Artefacts

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Collection of forensic tools

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

YARA signature and IOC database for my scanners and tools

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

Loki - Simple IOC and YARA Scanner

A repository of sysmon configuration modules

Extracted Yara rules from Windows Defender mpavbase and mpasbase

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

Extracted Yara rules from Windows Defender mpavbase and mpasbase

A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts

Convert a variety of log formats to CSV while enriching detected IPs with Geolocation, ASN, DNS, WhoIs, Shodan InternetDB and Threat Indicator matches.

PowerShell script designed to help Incident Responders collect forensic evidence from local and remote Windows devices.

This is a repository dedicated to the DFIR journey. Contains notes, reflections and links to tools.

yara detection rules for hunting with the threathunting-keywords project

Collection of forensic tools

Awesome Security lists for SOC/CERT/CTI

LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...

Handbook of windows forensic artifacts across multiple Windows version with interpretation tips and some examples. Work in progress!

Graphical interface for the forensic logical acquisition of Mac computers

KQL Queries. Microsoft Defender, Microsoft Sentinel

A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.

Helm charts for running open source digital forensic tools in Kubernetes

Multi-quarantine extractor

Awesome list of keywords and artifacts for Threat Hunting sessions

A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.

A curated list of tools for incident response. With repository stars⭐ and forks🍴

A cross platform forensic parser written in Rust!

Sigma detection rules for hunting with the threathunting-keywords project