Repository Index

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

• forensics
• mobile
• security
• android

Dshell is a network forensic analysis framework.

GRR Rapid Response: remote live forensics for incident response

Volatility 3.0 development

• digital-investigation
• forensics
• incident-response
• malware

TranslatedWeChat 4.x database decryption and analysis, supporting real-time updates, export of chat records and Moments, and annual summaries.

Collaborative forensic timeline analysis

• forensics
• dfir
• security
• timeline

Investigate malicious Windows logon by visualizing and analyzing Windows event log

• security
• dfir
• javascript
• visualization

Super timeline all the things

• forensics
• parsing
• timeline

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

• forensics
• python
• android

Collaborative Incident Response platform

• forensic
• incident-response
• csirt-tooling
• python

Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

• google-chrome
• hindsight
• chrome
• forensics

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

• digital-security
• forensics
• incident-response
• ioc

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

• dfir
• dissect
• python

macOS (& ios) Artifact Parsing Tool

• dfir
• forensics
• macos

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

• sigma
• python3
• evtx
• sigma-rules

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics

DFIRTrack - The Incident Response Tracking Application

• incident-response
• digital-forensics
• dfir
• incident-response-tooling

The repository host gives no description.

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

Web App for Volatility framework

A framework for orchestrating forensic collection, processing and data export