Repository Index

Investigate malicious Windows logon by visualizing and analyzing Windows event log

• security
• dfir
• javascript
• visualization

OS X Auditor is a free Mac OS X computer forensics tool

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.

• forensic
• recovery
• digital-forensics

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte

• incident-response
• malware-detection
• persistence
• powershell

Linux应急处置/信息搜集/漏洞检测工具，支持基础配置/网络流量/任务计划/环境变量/用户信息/Services/bash/恶意文件/内核Rootkit/SSH/Webshell/挖矿文件/挖矿进程/供应链/服务器风险等13类70+项检查

• linux
• rkhunter
• shell-script
• check

基于Memprocfs和Volatility的可视化内存取证工具

• ctf
• memprocfs
• volatility
• ctftools

Utilities for Sysmon

• sysmon
• threatintel
• sysinternals
• threat-hunting

UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.

• incident-response
• forensics
• computer-forensics
• triage

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

Digital Forensics Investigation Platform

• dfir
• security
• incident-response
• artifacts

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft

Investigate suspicious activity by visualizing Sysmon's event log

• security
• kibana
• elasticsearch
• sysmon

Script for automating Linux memory capture and analysis

Web interface for the Volatility Memory Forensics Framework

Sandia Cyber Omni Tracker (SCOT)

• perl
• javascript
• cyber-security
• incident-response

This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.

Windows Live Artifacts Acquisition Script

tr4mpass: Multi-path iOS exploitation framework for A5-A17 with checkm8/checkm9 and forensic gatheri

• a12-bypass
• activator
• bypassing
• checkm8

Based on the Volatility framework, this script will run various plugins as well as create a timeline, or use YARA/ClamAV/VirusTotal to find badness.