Repository Index

Remote forensics meta tool

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

Forensics artefact collection tool for systems running Microsoft Windows

• dfir
• incident-response
• collection

Cyber Incident Response Team Playbook Battle Cards

• playbook-battle-cards
• cybersecurity
• cyber-threats
• cyber-security-team

Investigate suspicious activity by visualizing Sysmon's event log

• security
• kibana
• elasticsearch
• sysmon

Web App for Volatility framework

A framework for orchestrating forensic collection, processing and data export

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices

Python installable command line utiltity for mitigation of host and key compromises.

Evidence-based DSM ransomware recovery: preservation, RAM key recovery, copy decryption, and GitLab validation.

$MFT directory tree reconstruction & FILE record info

• mft-browser
• mft
• powershell
• winform

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

• forensics
• hypervisor
• memory-dump
• reverse-engineering

Automatically exported from code.google.com/p/creddump

ROPMEMU is a framework to analyze, dissect and decompile complex code-reuse attacks.

The Volatility Collaborative GUI

• volatility-gui
• volatility-framework
• volatility
• memory-dump

Script for automating Linux memory capture and analysis

We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.

• cybersecurity
• cybersecurity-tools
• incident-response
• security

VolatilityBot – An automated memory analyzer for malware samples and memory dumps

Incident Response - Fast suspicious file finder

• dfir
• investigation
• incident-response
• threat-hunting

Web interface for the Volatility Memory Forensics Framework

Memory acquisition for Linux that makes sense.

Sandia Cyber Omni Tracker (SCOT)

• perl
• javascript
• cyber-security
• incident-response

Remote Memory Acquisition Tool