A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
Repository Index
47,133 repositories indexed
49–72 of 80 · Most stars
Forensics artefact collection tool for systems running Microsoft Windows
- dfir
- incident-response
- collection
Cyber Incident Response Team Playbook Battle Cards
- playbook-battle-cards
- cybersecurity
- cyber-threats
- cyber-security-team
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
Python installable command line utiltity for mitigation of host and key compromises.
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.
- cybersecurity
- cybersecurity-tools
- incident-response
- security
Incident Response - Fast suspicious file finder
- dfir
- investigation
- incident-response
- threat-hunting
Sandia Cyber Omni Tracker (SCOT)
- perl
- javascript
- cyber-security
- incident-response
Remote Memory Acquisition Tool
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
simple YARA-based IOC scanner
- yara
- ioc
- security
- incident-response
Tools for the Computer Incident Response Team :computer:
- dfir
- python
- carbonblack
- malware-analysis
Invoke-LiveResponse
- ir
- dfir
- winrm
- liveresponse
Incident Response Triage - Windows Evidence Collection for Forensic Analysis
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
analyze a web-based network traffic 🕶 to detect central command and control servers
- squid
- network-traffic
- proxy-server
- incident-response
Defensomania is a security monitoring and incident response card game.
- incident-response
- self-assessment
- incident-response-readiness
- educational-game
Mimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
A tool to catch spoofed NBNS responses.
PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.
- powershell
- powershell-modules
- incident-response
- containment
ESPot - ElasticSearch Honeypot