A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Repository Index
47,133 repositories indexed
1–17 of 17 · Most stars
Loki - Simple IOC and YARA Scanner
- python
- yara
- signature
- scanner
Collaborative forensic timeline analysis
Investigate malicious Windows logon by visualizing and analyzing Windows event log
- security
- dfir
- javascript
- visualization
Your Everyday Threat Intelligence
- infosec
- threatintel
- threat-sharing
- threat-hunting
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
- google-chrome
- hindsight
- chrome
- forensics
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
- dfir
- dissect
- python
Malcom - Malware Communications Analyzer
- malware
- network-traffic
- pcap
- threat-intelligence
macOS (& ios) Artifact Parsing Tool
Extract and aggregate threat intelligence.
- ioc
- indicators-of-compromise
- threatintel
- threat-intelligence
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
Defanged Indicator of Compromise (IOC) Extractor.
- ioc
- indicators-of-compromise
- library
- ioc-extractor
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
Tools for the Computer Incident Response Team :computer:
- dfir
- python
- carbonblack
- malware-analysis
A simple many-rules to many-files YARA scanner for incident response or malware zoos.
- yara
- yara-scanner
- incident-response
- dfir