Trending repositories for topic dfir

A curated list of tools for incident response

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Rapidly Search and Hunt through Windows Forensic Artefacts

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

IntelOwl: manage your Threat Intelligence at scale

Awesome Security lists for SOC/CERT/CTI

Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in this exciting journey and add your expertise to our collective eff...

Your Everyday Threat Intelligence

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Windows Events Attack Samples

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Awesome list of keywords and artifacts for Threat Hunting sessions

Warning lists to inform users of MISP about potential false-positives or other information in indicators

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

Cortex: a Powerful Observable Analysis and Active Response Engine

Educational, CTF-styled labs for individuals interested in Memory Forensics

Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in this exciting journey and add your expertise to our collective eff...

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

Awesome Security lists for SOC/CERT/CTI

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Rapidly Search and Hunt through Windows Forensic Artefacts

Awesome list of keywords and artifacts for Threat Hunting sessions

Warning lists to inform users of MISP about potential false-positives or other information in indicators

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Your Everyday Threat Intelligence

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

A curated list of tools for incident response

IntelOwl: manage your Threat Intelligence at scale

Windows Events Attack Samples

Cortex: a Powerful Observable Analysis and Active Response Engine

Educational, CTF-styled labs for individuals interested in Memory Forensics

A repository of sysmon configuration modules

Collaborative forensic timeline analysis

A curated list of tools for incident response

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

⭐️ A curated list of awesome forensic analysis tools and resources

Rapidly Search and Hunt through Windows Forensic Artefacts

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

Investigate malicious Windows logon by visualizing and analyzing Windows event log

Your Everyday Threat Intelligence

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

YARA signature and IOC database for my scanners and tools

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

You didn't think I'd go and leave the blue team out, right?

Educational, CTF-styled labs for individuals interested in Memory Forensics

IntelOwl: manage your Threat Intelligence at scale

Awesome Security lists for SOC/CERT/CTI

Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in this exciting journey and add your expertise to our collective eff...

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

This is a repository dedicated to the DFIR journey. Contains notes, reflections and links to tools.

Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in this exciting journey and add your expertise to our collective eff...

Dumps all of the Key/Value pairs from a LevelDB database

TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Awesome Security lists for SOC/CERT/CTI

(Sometimes partial) Python re-implementations of the technologies involved in reading various data sources in Chrome-esque applications.

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes

A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4

Warning lists to inform users of MISP about potential false-positives or other information in indicators

Extracted Yara rules from Windows Defender mpavbase and mpasbase

Awesome list of keywords and artifacts for Threat Hunting sessions

Your Everyday Threat Intelligence

Rapidly Search and Hunt through Windows Forensic Artefacts

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Rapidly Search and Hunt through Windows Forensic Artefacts

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

A curated list of tools for incident response

⭐️ A curated list of awesome forensic analysis tools and resources

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

Awesome Security lists for SOC/CERT/CTI

Loki - Simple IOC and YARA Scanner

IntelOwl: manage your Threat Intelligence at scale

LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

YARA signature and IOC database for my scanners and tools

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4

Your Everyday Threat Intelligence

LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...

This is a repository dedicated to the DFIR journey. Contains notes, reflections and links to tools.

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.

yara detection rules for hunting with the threathunting-keywords project

Handbook of windows forensic artifacts across multiple Windows version with interpretation tips and some examples. Work in progress!

PowerShell script designed to help Incident Responders collect forensic evidence from local and remote Windows devices.

Harness the power of Splunk for your investigations

Graphical interface for the forensic logical acquisition of Mac computers

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

Helm charts for running open source digital forensic tools in Kubernetes

Awesome Security lists for SOC/CERT/CTI

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...

A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Extracted Yara rules from Windows Defender mpavbase and mpasbase

Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in this exciting journey and add your expertise to our collective eff...

Awesome list of keywords and artifacts for Threat Hunting sessions

OneDrive log .ODL reader

Rapidly Search and Hunt through Windows Forensic Artefacts

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Collection of forensic tools

Extracted Yara rules from Windows Defender mpavbase and mpasbase

LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...

Harness the power of Splunk for your investigations

Graphical interface for the forensic logical acquisition of Mac computers

Windows Administrator level Implant.

A curated list of tools for incident response

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

IntelOwl: manage your Threat Intelligence at scale

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

⭐️ A curated list of awesome forensic analysis tools and resources

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Awesome Security lists for SOC/CERT/CTI

Rapidly Search and Hunt through Windows Forensic Artefacts

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Collection of forensic tools

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

YARA signature and IOC database for my scanners and tools

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

Loki - Simple IOC and YARA Scanner

A repository of sysmon configuration modules

Automate the creation of a lab environment complete with security tooling and logging best practices

Awesome list of keywords and artifacts for Threat Hunting sessions

Extracted Yara rules from Windows Defender mpavbase and mpasbase

A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts

A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.

Convert a variety of log formats to CSV while enriching detected IPs with Geolocation, ASN, DNS, WhoIs, Shodan InternetDB and Threat Indicator matches.

PowerShell script designed to help Incident Responders collect forensic evidence from local and remote Windows devices.

yara detection rules for hunting with the threathunting-keywords project

This is a repository dedicated to the DFIR journey. Contains notes, reflections and links to tools.

Collection of forensic tools

Awesome Security lists for SOC/CERT/CTI

LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...

Handbook of windows forensic artifacts across multiple Windows version with interpretation tips and some examples. Work in progress!

Graphical interface for the forensic logical acquisition of Mac computers

KQL Queries. Microsoft Defender, Microsoft Sentinel

A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.

Awesome list of keywords and artifacts for Threat Hunting sessions

Helm charts for running open source digital forensic tools in Kubernetes

Multi-quarantine extractor

A cross platform forensic parser written in Rust!

A curated list of tools for incident response. With repository stars⭐ and forks🍴

Sigma detection rules for hunting with the threathunting-keywords project