Investigate malicious Windows logon by visualizing and analyzing Windows event log
- security
- dfir
- javascript
- visualization
Repository Index
47,133 repositories indexed
1–18 of 18 · Most stars
OS X Auditor is a free Mac OS X computer forensics tool
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
ThePhish: an automated phishing email analysis tool
Digital Forensics Investigation Platform
- dfir
- security
- incident-response
- artifacts
RegRipper3.0
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
Investigate suspicious activity by visualizing Sysmon's event log
- security
- kibana
- elasticsearch
- sysmon
Script for automating Linux memory capture and analysis
We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.
- cybersecurity
- cybersecurity-tools
- incident-response
- security
Web interface for the Volatility Memory Forensics Framework
Sandia Cyber Omni Tracker (SCOT)
- perl
- javascript
- cyber-security
- incident-response
This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.
Windows Live Artifacts Acquisition Script
Follow stolen crypto hop by hop across Bitcoin, Ethereum, TRON, BNB Chain and Solana. Labels where the money landed, keeps proof for every clue, writes the report.
Based on the Volatility framework, this script will run various plugins as well as create a timeline, or use YARA/ClamAV/VirusTotal to find badness.