Repository Index

A curated list of tools for incident response

• incident-response
• security
• cybersecurity
• dfir

⭐️ A curated list of awesome forensic analysis tools and resources

• computer-forensics
• digital-forensics
• forensic-analysis
• dfir

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis

Loki - Simple IOC and YARA Scanner

• python
• yara
• signature
• scanner

Rapidly Search and Hunt through Windows Forensic Artefacts

• attack
• rust
• security
• threat-hunting

Collaborative forensic timeline analysis

• forensics
• dfir
• security
• timeline

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

• dfir
• threat
• hunting
• windows

Investigate malicious Windows logon by visualizing and analyzing Windows event log

• security
• dfir
• javascript
• visualization

A repository of sysmon configuration modules

• sysmon
• dfir
• threat-hunting
• mitre-attack

Windows Events Attack Samples

• threat-hunting
• evtx
• windows-security
• mitre-attack

Your Everyday Threat Intelligence

• infosec
• threatintel
• threat-sharing
• threat-hunting

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

• azure
• defender-for-endpoint
• dfir
• kql

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

• aws
• cloud
• security
• big-data

Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

• google-chrome
• hindsight
• chrome
• forensics

UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.

• incident-response
• forensics
• computer-forensics
• triage

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

• dfir
• dissect
• python

Malcom - Malware Communications Analyzer

• malware
• network-traffic
• pcap
• threat-intelligence

macOS (& ios) Artifact Parsing Tool

• dfir
• forensics
• macos

Extract and aggregate threat intelligence.

• ioc
• indicators-of-compromise
• threatintel
• threat-intelligence

Digital Forensics Investigation Platform

• dfir
• security
• incident-response
• artifacts

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

• sigma
• python3
• evtx
• sigma-rules

Collection of Event ID ressources useful for Digital Forensics and Incident Response

• ir
• dfir
• digitalforensics
• forensics

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics

Defanged Indicator of Compromise (IOC) Extractor.

• ioc
• indicators-of-compromise
• library
• ioc-extractor