Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
Repository Index
47,133 repositories indexed
1–23 of 23 · Most stars
Network Analysis Tool
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
Incident Response Forensic Framework
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
- forensics
- hypervisor
- memory-dump
- reverse-engineering
Memory acquisition for Linux that makes sense.
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.
EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
Cross-platform, open-source shellbag parser
Incident Response Triage - Windows Evidence Collection for Forensic Analysis
Command line utility and Python package to ease the (un)mounting of forensic disk images
acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.
The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.
- acquisition
- cybersecurity
- forensics
- iscsi
A tool to extract local data storage of an Android application in one click.
- android-extract
- android
- storage
- security-tools