Repository Index

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

Digital Forensics artifact repository

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

• digital-security
• forensics
• incident-response
• ioc

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

• dfir
• dissect
• python

AVML - Acquire Volatile Memory for Linux

• rust
• memory-forensics
• linux-security

macOS (& ios) Artifact Parsing Tool

• dfir
• forensics
• macos

Digital Forensics Investigation Platform

• dfir
• security
• incident-response
• artifacts

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

• sigma
• python3
• evtx
• sigma-rules

Dynamic unpacker based on PE-sieve

• libpeconv
• pe-sieve
• memory-forensics
• malware-unpacker

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics

Incident Response Forensic Framework

DFIRTrack - The Incident Response Tracking Application

• incident-response
• digital-forensics
• dfir
• incident-response-tooling

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft

Remote forensics meta tool

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

A Linux packet crafting tool.

• packet-crafting
• networking
• hacking-tool
• intrusion-prevention

Forensics artefact collection tool for systems running Microsoft Windows

• dfir
• incident-response
• collection

A framework for orchestrating forensic collection, processing and data export

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices

inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

• forensics
• hypervisor
• memory-dump
• reverse-engineering

Web interface for the Volatility Memory Forensics Framework