Incident Response Forensic Framework
Repository Index
47,133 repositories indexed
49–72 of 79 · Most stars
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
An open‑source technical wiki connected to the systems it describes
- confluence-alternative
- dashboard
- incident-response
- internal-documentation
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
Forensics artefact collection tool for systems running Microsoft Windows
- dfir
- incident-response
- collection
Cyber Incident Response Team Playbook Battle Cards
- playbook-battle-cards
- cybersecurity
- cyber-threats
- cyber-security-team
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.
- cybersecurity
- cybersecurity-tools
- incident-response
- security
Incident Response - Fast suspicious file finder
- dfir
- investigation
- incident-response
- threat-hunting
Sandia Cyber Omni Tracker (SCOT)
- perl
- javascript
- cyber-security
- incident-response
This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.
simple YARA-based IOC scanner
- yara
- ioc
- security
- incident-response
Tools for the Computer Incident Response Team :computer:
- dfir
- python
- carbonblack
- malware-analysis
Invoke-LiveResponse
- ir
- dfir
- winrm
- liveresponse
Incident Response Triage - Windows Evidence Collection for Forensic Analysis
WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
analyze a web-based network traffic 🕶 to detect central command and control servers
- squid
- network-traffic
- proxy-server
- incident-response
Defensomania is a security monitoring and incident response card game.
- incident-response
- self-assessment
- incident-response-readiness
- educational-game
Mimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.
PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.