MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Repository Index
47,133 repositories indexed
1–19 of 19 · Most stars
GRR Rapid Response: remote live forensics for incident response
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
Security sensor for realtime threat detection and protection
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
- google-chrome
- hindsight
- chrome
- forensics
Scalpel is an open source data carving tool. It is not being actively maintained.
CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
WinDBG Anti-RootKit Extension
- kernel-mode
- c-plus-plus
- malware
- malware-analysis
:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
Remote forensics meta tool
VolatilityBot – An automated memory analyzer for malware samples and memory dumps
Sandia Cyber Omni Tracker (SCOT)
- perl
- javascript
- cyber-security
- incident-response
Remote Memory Acquisition Tool
The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange.
Foremost is a console program to recover files based on their headers, footers, and internal data structures. c.f., http://foremost.sourceforge.net/
Based on the Volatility framework, this script will run various plugins as well as create a timeline, or use YARA/ClamAV/VirusTotal to find badness.
Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.
- acquisition
- cybersecurity
- forensics
- iscsi