Repository Index

PagerDuty's Incident Response Documentation.

• pagerduty
• incident-response
• documentation
• oncall

"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.

• pentesting
• hacking
• hacking-tool
• pentest-tool

An Intelligent wordlist generator based on user profiling, permutations, and statistics. (Named after the same tool in Mr.Robot series S01E01)

• elliot
• cupp
• passwords
• hacking-tool

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.

Digital Forensics Investigation Platform

• dfir
• security
• incident-response
• artifacts

A concise, directive, specific, flexible, and free incident response plan template

• incident-response
• incident
• incident-management
• infosec

ObjectivePGP is an open-source library for iOS and macOS that provides developers with tools for implementing OpenPGP encryption and decryption, digital signing, and signature verification in their applications, thereby enhancing security and data integrity.

• openpgp
• objective-c
• encryption
• pgp

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

• clamscan
• file-scanner
• virus-scan
• docker-compose

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics

Incident Response Forensic Framework

DFIRTrack - The Incident Response Tracking Application

• incident-response
• digital-forensics
• dfir
• incident-response-tooling

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

Forensics artefact collection tool for systems running Microsoft Windows

• dfir
• incident-response
• collection

Cyber Incident Response Team Playbook Battle Cards

• playbook-battle-cards
• cybersecurity
• cyber-threats
• cyber-security-team

HIBA is a system built on top of regular OpenSSH certificate-based authentication that allows to manage flexible authorization of principals on pools of target hosts without the need to push customized authorized_users files periodically.

• ssh
• authorization

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.

• cybersecurity
• cybersecurity-tools
• incident-response
• security

Incident Response - Fast suspicious file finder

• dfir
• investigation
• incident-response
• threat-hunting

Sandia Cyber Omni Tracker (SCOT)

• perl
• javascript
• cyber-security
• incident-response

This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.