Trending repositories for topic dfir
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
Rapidly Search and Hunt through Windows Forensic Artefacts
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Awesome list of keywords and artifacts for Threat Hunting sessions
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...
Documentation and scripts to properly enable Windows event logs.
TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.
This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts...
WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅(ウェラ)
Educational, CTF-styled labs for individuals interested in Memory Forensics
TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.
This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
Awesome list of keywords and artifacts for Threat Hunting sessions
MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...
Documentation and scripts to properly enable Windows event logs.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts...
Rapidly Search and Hunt through Windows Forensic Artefacts
WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅(ウェラ)
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
Educational, CTF-styled labs for individuals interested in Memory Forensics
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Rapidly Search and Hunt through Windows Forensic Artefacts
A curated list of tools for incident response
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...
Educational, CTF-styled labs for individuals interested in Memory Forensics
Documentation and scripts to properly enable Windows event logs.
List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
Awesome list of keywords and artifacts for Threat Hunting sessions
Automate the creation of a lab environment complete with security tooling and logging best practices
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.
This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
Documentation and scripts to properly enable Windows event logs.
Awesome list of keywords and artifacts for Threat Hunting sessions
Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...
MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
Handbook of windows forensic artifacts across multiple Windows version with interpretation tips and some examples. Work in progress!
⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes
Forensics artefact collection tool for systems running Microsoft Windows
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Educational, CTF-styled labs for individuals interested in Memory Forensics
The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts...
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
A curated list of tools for incident response
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
Rapidly Search and Hunt through Windows Forensic Artefacts
⭐️ A curated list of awesome forensic analysis tools and resources
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
TheHive: a Scalable, Open Source and Free Security Incident Response Platform
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...
This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
Investigate malicious Windows logon by visualizing and analyzing Windows event log
This page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
Graphical interface for the forensic logical acquisition of Mac computers
TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.
This is a repository dedicated to the DFIR journey. Contains notes, reflections and links to tools.
Handbook of windows forensic artifacts across multiple Windows version with interpretation tips and some examples. Work in progress!
yara detection rules for hunting with the threathunting-keywords project
Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in this exciting journey and add your expertise to our collective eff...
Sigma detection rules for hunting with the threathunting-keywords project
MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
(Sometimes partial) Python re-implementations of the technologies involved in reading various data sources in Chrome-esque applications.
Provides various Windows Server Active Directory (AD) security-focused reports.
Awesome list of keywords and artifacts for Threat Hunting sessions
⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...
A curated list of tools for incident response
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
⭐️ A curated list of awesome forensic analysis tools and resources
MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Rapidly Search and Hunt through Windows Forensic Artefacts
List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
TheHive: a Scalable, Open Source and Free Security Incident Response Platform
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD an...
A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts
Convert a variety of log formats to CSV while enriching detected IPs with Geolocation, ASN, DNS, WhoIs, Shodan InternetDB and Threat Indicator matches.
PowerShell script designed to help Incident Responders collect forensic evidence from local and remote Windows devices.
This is a repository dedicated to the DFIR journey. Contains notes, reflections and links to tools.
yara detection rules for hunting with the threathunting-keywords project
LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of ...
Handbook of windows forensic artifacts across multiple Windows version with interpretation tips and some examples. Work in progress!
Graphical interface for the forensic logical acquisition of Mac computers
KQL Queries. Microsoft Defender, Microsoft Sentinel
A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
Helm charts for running open source digital forensic tools in Kubernetes
Awesome list of keywords and artifacts for Threat Hunting sessions
A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.
A curated list of tools for incident response. With repository stars⭐ and forks🍴
Sigma detection rules for hunting with the threathunting-keywords project