Repository Index

PowerForensics provides an all in one platform for live disk forensic analysis

This is the development tree. Production downloads are at:

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

• digital-security
• forensics
• incident-response
• ioc

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

• dfir
• dissect
• python

AVML - Acquire Volatile Memory for Linux

• rust
• memory-forensics
• linux-security

macOS (& ios) Artifact Parsing Tool

• dfir
• forensics
• macos

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.

Digital Forensics Investigation Platform

• dfir
• security
• incident-response
• artifacts

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

• sigma
• python3
• evtx
• sigma-rules

CyLR - Live Response Collection Tool

RegRipper3.0

Scalpel is an open source data carving tool. It is not being actively maintained.

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics

Incident Response Forensic Framework

DFIRTrack - The Incident Response Tracking Application

• incident-response
• digital-forensics
• dfir
• incident-response-tooling

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

The repository host gives no description.

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft