Repository Index

Tools for the Computer Incident Response Team :computer:

• dfir
• python
• carbonblack
• malware-analysis

Invoke-LiveResponse

• ir
• dfir
• winrm
• liveresponse

Incident Response Triage - Windows Evidence Collection for Forensic Analysis

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

• c
• forensics
• log-analysis
• security

analyze a web-based network traffic 🕶 to detect central command and control servers

• squid
• network-traffic
• proxy-server
• incident-response

Defensomania is a security monitoring and incident response card game.

• incident-response
• self-assessment
• incident-response-readiness
• educational-game

Mimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.

• backdoor
• honeypot
• incident-response
• security

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

A tool to catch spoofed NBNS responses.

PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.

• powershell
• powershell-modules
• incident-response
• containment

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

• yara
• yara-scanner
• incident-response
• dfir

Inserts a trap for spam bots into responses.

• php
• middleware
• honeypot
• stack

Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.

• bpf
• ebpf
• forensics
• goroutine