Incident Response
218 items from meirwah/awesome-incident-response ★9,444
-
Network Flight Simulator github.com
Lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility.
-
sysmon-config github.com
Sysmon configuration file template with default high-quality event tracing
-
RedHunt-OS github.com
Virtual machine for adversary emulation and threat hunting.
-
Forensic Artifacts github.com
Digital Forensics Artifact Repository
-
Metta github.com
Information security preparedness tool to do adversarial simulation.
-
ThreatHunter-Playbook github.com
Playbook to aid the development of techniques and hypothesis for hunting campaigns.
-
Volatility 3 github.com
The volatile memory extraction framework (successor of Volatility)
-
DumpsterFire github.com
Modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale…
-
https://github.com/ufrisk/MemProcFS github.com
) - MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.
-
Velociraptor github.com
Endpoint visibility and collection tool
-
Cynative github.com
Framework for building security engineering AI agents in Go. Read-only by construction, built-in sandbox, 45 agent blueprints for AWS, GCP, Azure, K8s, GitHub & GitLab deep research.
-
Rizin github.com
UNIX-like reverse engineering framework and command-line toolset
-
Chainsaw github.com
Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows event logs.
-
CAPEv2 github.com
Malware Configuration And Payload Extraction.
-
Hayabusa github.com
Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool created by the Yamato Security group in Japan.
-
StringSifter github.com
A machine learning tool that ranks strings based on their relevance for malware analysis.
-
sysmon-modular github.com
A repository of sysmon configuration modules
-
Security Onion github.com
Special Linux distro aimed at network security monitoring featuring advanced analysis tools.
-
CyLR github.com
NTFS forensic image collector
-
StreamAlert github.com
Serverless, real-time log data analysis framework, capable of ingesting custom data sources and triggering alerts using user-defined logic.
-
CimSweep github.com
Suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
-
Windows Events Attack Samples github.com
Windows Events Attack Samples
-
Didier Stevens Suite github.com
Tool collection
-
Shuffle github.com
A general purpose security automation platform focused on accessibility.
-
Plaso github.com
a Python-based backend engine for the tool log2timeline.
-
PSRecon github.com
PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over…
-
Meerkat github.com
PowerShell-based Windows artifact collection for threat hunting and incident response.
-
threat_note github.com
Lightweight investigation notebook that allows security researchers the ability to register and retrieve indicators related to their research.
-
Kansa github.com
Modular incident response framework in PowerShell.
-
IRIS github.com
IRIS is a web collaborative platform for incident response analysts allowing to share investigations at a technical level.
-
Hindsight github.com
Internet history forensics for Google Chrome/Chromium.
-
UAC github.com
UAC (Unix-like Artifacts Collector) is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
-
APT Hunter github.com
APT-Hunter is Threat Hunting tool for windows event logs.
-
inVtero.net github.com
Advanced memory analysis for Windows x64 with nested hypervisor support.
-
Dissect github.com
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
-
Hostintel github.com
Pull intelligence per host.
-
IRM github.com
Incident Response Methodologies by CERT Societe Generale.
-
AVML github.com
A portable volatile memory acquisition tool for Linux.
-
Red Team Automation (RTA) github.com
RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.
-
evolve github.com
Web interface for the Volatility Memory Forensics Framework.
-
macOS Artifact Parsing Tool (mac_apt) github.com
Plugin based forensics framework for quick mac triage that works on live machines, disk images or individual artifact files.
-
Aurora Incident Response github.com
Platform developed to build easily a detailed timeline of an incident.
-
Margarita Shotgun github.com
Command line utility (that works with or without Amazon EC2 instances) to parallelize remote memory acquisition.
-
Morgue github.com
PHP Web app by Etsy for managing postmortems.
-
rastrea2r github.com
Allows one to scan disks and memory for IOCs using YARA on Windows, Linux and OS X.
-
List of various Security APIs github.com
Collective list of public JSON APIs for use in security.
-
Raccine github.com
A Simple Ransomware Protection
-
Kuiper github.com
Digital Forensics Investigation Platform
-
Zentral github.com
Combines osquery's powerful endpoint inventory features with a flexible notification and action framework. This enables one to identify and react to changes on OS X and Linux clients.
-
Zircolite github.com
A standalone and fast SIGMA-based detection tool for EVTX or JSON.
- next page of items loading…
