Repository Index

A collection of postmortem templates

• site-reliability-engineering
• site-reliability
• devops
• postmortem

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

Creates up to a thousand WiFi access points with custom SSIDs.

• ssid
• custom-ssids
• wifi
• esp8266

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

:rocket: An open source alternative to searx which provides a modern-looking :sparkles:, lightning-fast :zap:, privacy respecting :disguised_face:, secure :lock: meta search engine

• meta-search-engine
• rust
• search-engine
• fast

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

• digital-security
• forensics
• incident-response
• ioc

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

• dfir
• dissect
• python

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

• cybersecurity
• threat
• ioc
• malware

SIPVicious OSS is a VoIP security testing toolset. It helps security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against PBX systems especially through identification, scanning, extension enumeration and password cracking.

• sip
• voip
• password-cracker
• svwar

PagerDuty's Incident Response Documentation.

• pagerduty
• incident-response
• documentation
• oncall

"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.

• pentesting
• hacking
• hacking-tool
• pentest-tool

Detect deauthentication frames using an ESP8266

• arduino
• esp8266
• deauth
• attack

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.

Digital Forensics Investigation Platform

• dfir
• security
• incident-response
• artifacts

A concise, directive, specific, flexible, and free incident response plan template

• incident-response
• incident
• incident-management
• infosec

Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.

• codereview
• cybersecurity
• ruby
• sinatra

CyLR - Live Response Collection Tool

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics

Incident Response Forensic Framework

DFIRTrack - The Incident Response Tracking Application

• incident-response
• digital-forensics
• dfir
• incident-response-tooling

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft