Repository Index

GRR Rapid Response: remote live forensics for incident response

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

• pe-format
• hooking
• pe-dumper
• pe-analyzer

Rapidly Search and Hunt through Windows Forensic Artefacts

• attack
• rust
• security
• threat-hunting

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

• dfir
• threat
• hunting
• windows

Collaborative forensic timeline analysis

• forensics
• dfir
• security
• timeline

Investigate malicious Windows logon by visualizing and analyzing Windows event log

• security
• dfir
• javascript
• visualization

Super timeline all the things

• forensics
• parsing
• timeline

A network sniffer that logs all DNS server replies for use in a passive DNS setup

Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

• google-chrome
• hindsight
• chrome
• forensics

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

• sigma
• python3
• evtx
• sigma-rules

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

Investigate suspicious activity by visualizing Sysmon's event log

• security
• kibana
• elasticsearch
• sysmon

A framework for orchestrating forensic collection, processing and data export

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

Automatically exported from code.google.com/p/creddump

Open Source SIEM (Security Information and Event Management system).

• siem
• risk-management
• risk-assessment
• vulnerability-management

Apache Logfile Security Analyzer

EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.

Autonomous DFIR agent: point it at disk images, memory dumps or log exports and get back an investigation that shows its work. Volatility 3, Plaso, YARA and any OpenAI-compatible LLM.

• ai-agent
• dfir
• digital-forensics
• incident-response

The repository host gives no description.

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

• c
• forensics
• log-analysis
• security

Foremost is a console program to recover files based on their headers, footers, and internal data structures. c.f., http://foremost.sourceforge.net/