Repository Index

Digital Forensics Investigation Platform

• dfir
• security
• incident-response
• artifacts

A concise, directive, specific, flexible, and free incident response plan template

• incident-response
• incident
• incident-management
• infosec

CyLR - Live Response Collection Tool

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics

Incident Response Forensic Framework

DFIRTrack - The Incident Response Tracking Application

• incident-response
• digital-forensics
• dfir
• incident-response-tooling

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

Forensics artefact collection tool for systems running Microsoft Windows

• dfir
• incident-response
• collection

Cyber Incident Response Team Playbook Battle Cards

• playbook-battle-cards
• cybersecurity
• cyber-threats
• cyber-security-team

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices

Python installable command line utiltity for mitigation of host and key compromises.

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.

• cybersecurity
• cybersecurity-tools
• incident-response
• security

Incident Response - Fast suspicious file finder

• dfir
• investigation
• incident-response
• threat-hunting

Sandia Cyber Omni Tracker (SCOT)

• perl
• javascript
• cyber-security
• incident-response

Remote Memory Acquisition Tool

simple YARA-based IOC scanner

• yara
• ioc
• security
• incident-response

Tools for the Computer Incident Response Team :computer:

• dfir
• python
• carbonblack
• malware-analysis

Invoke-LiveResponse

• ir
• dfir
• winrm
• liveresponse

Incident Response Triage - Windows Evidence Collection for Forensic Analysis