Incident Response
218 items from meirwah/awesome-incident-response ★9,444
-
Munin github.com
Online hash checker for VirusTotal and other services.
-
AChoir github.com
Framework/scripting tool to standardize and simplify the process of scripting live acquisition utilities for Windows.
-
VolDiff github.com
Malware Memory Footprint Analysis based on Volatility.
-
MASTIFF github.com
Static analysis framework that automates the process of extracting key characteristics from a number of different file formats.
-
Fenrir github.com
Simple IOC scanner. It allows scanning any Linux/Unix/OSX system for IOCs in plain bash. Created by the creators of THOR and LOKI.
-
RegRipper github.com
Open source tool, written in Perl, for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis.
-
Diffy github.com
DFIR tool developed by Netflix's SIRT that allows an investigator to quickly scope a compromise across cloud instances (Linux instances on AWS, currently) during an incident and efficiently triaging those instances for followup actions by showing differences against a baseline.
-
Doorman github.com
osquery fleet manager that allows remote management of osquery configurations retrieved by nodes. It takes advantage of osquery's TLS configuration, logger, and distributed read/write endpoints, to give administrators visibility across a fleet of devices with minimal overhead…
-
Visualize_Logs github.com
Open source visualization library and command line tools for logs (Cuckoo, Procmon, more to come).
-
nightHawk github.com
Application built for asynchronous forensic data presentation using ElasticSearch as the backend. It's designed to ingest Redline collections.
-
Phantom Community Playbooks github.com
Phantom Community Playbooks for Splunk but also customizable for other use.
-
DFIRTrack github.com
Incident Response tracking application handling one or more incidents via cases and tasks with a lot of affected systems and artifacts.
-
Catalyst github.com
A free SOAR system that helps to automate alert handling and incident response processes.
-
Fileintel github.com
Pull intelligence per file hash.
-
CCF-VM github.com
CyLR CDQR Forensics Virtual Machine (CCF-VM): An all-in-one solution to parsing collected data, making it easily searchable with built-in common searches, enable searching of single and multiple hosts simultaneously.
-
FastIR Collector github.com
Tool that collects different artifacts on live Windows systems and records the results in csv files. With the analyses of these artifacts, an early compromise can be detected.
-
MalConfScan github.com
MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this…
-
Bitscout github.com
Bitscout by Vitaly Kamluk helps you build your fully-trusted customizable LiveCD/LiveUSB image to be used for remote digital forensics (or perhaps any other task of your choice). It is meant to be transparent and monitorable by the owner of the system, forensically sound…
-
GuardSIght Playbook Battle Cards github.com
A collection of Cyber Incident Response Playbook Battle Cards
-
SysmonSearch github.com
SysmonSearch makes Windows event log analysis more effective and less time consuming by aggregation of event logs.
-
SOC Multi-tool github.com
A powerful and user-friendly browser extension that streamlines investigations for security professionals.
-
Cuckoo-modified github.com
Heavily modified Cuckoo fork developed by community.
-
DFTimewolf github.com
A framework for orchestrating forensic collection, processing and data export.
-
Cold Disk Quick Response github.com
Streamlined list of parsers to quickly analyze a forensic image file (dd, E01, .vmdk, etc) and output nine reports.
-
MFT Browser github.com
MFT directory tree reconstruction & record info.
-
virustotal virustotal.com
VirusTotal, a subsidiary of Google, is a free online service that analyzes files and URLs enabling the identification of viruses, worms, trojans and other kinds of malicious content detected by antivirus engines and website scanners. At the same time, it may be used as a means…
-
artifactcollector github.com
The artifactcollector project provides a software that collects forensic artifacts on systems.
-
Orochi github.com
Orochi is an open source framework for collaborative forensic memory dump analysis.
-
Linux Memory Grabber github.com
Script for dumping Linux memory and creating Volatility profiles.
-
VolatilityBot github.com
Automation tool for researchers cuts all the guesswork and manual tasks out of the binary extraction phase, or to help the investigator in the first steps of performing a memory analysis investigation.
-
AutoTTP github.com
Automated Tactics Techniques & Procedures. Re-running complex sequences manually for regression tests, product evaluations, generate data for researchers.
-
Sandia Cyber Omni Tracker (SCOT) github.com
Incident Response collaboration and knowledge capture tool focused on flexibility and ease of use. Our goal is to add value to the incident response process without burdening the user.
-
MAGNET DumpIt github.com
Fast memory acquisition open source tool for Linux written in Rust. Generate full memory crash dumps of Linux machines.
-
Hoarder github.com
Collecting the most valuable artifacts for forensics or incident response investigations.
-
Lorg github.com
Tool for advanced HTTPD logfile security analysis and forensics.
-
MutableSecurity github.com
CLI program for automating the setup, configuration, and use of cybersecurity solutions.
-
AppCompatProcessor github.com
AppCompatProcessor has been designed to extract additional value from enterprise-wide AppCompat / AmCache data beyond the classic stacking and grepping techniques.
-
Windows Registry Knowledge Base github.com
Windows Registry Knowledge Base
-
Spyre github.com
Simple YARA-based IOC scanner written in Go
-
FastIR Collector Linux github.com
FastIR for Linux collects different artifacts on live Linux and records the results in CSV files.
-
PowerSponse github.com
PowerSponse is a PowerShell module focused on targeted containment and remediation during security incident response.
-
VanGuard github.com
Cross-platform incident response toolkit with 28 pre-built use cases in a single zero-install binary. Collects memory, disk, network, and cloud artifacts with automated timeline generation.
-
CIRTkit github.com
CIRTKit is not just a collection of tools, but also a framework to aid in the ongoing unification of Incident Response and Forensics investigation processes.
-
Invoke-LiveResponse github.com
Invoke-LiveResponse is a live response tool for targeted collection.
-
IRTriage github.com
Incident Response Triage - Windows Evidence Collection for Forensic Analysis.
-
imagemounter github.com
Command line utility and Python package to ease the (un)mounting of forensic disk images.
-
WELA github.com
Windows Event Log Analyzer aims to be the Swiss Army knife for Windows event logs.
-
Acquire github.com
Acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container. This makes Acquire an excellent tool to, among others, speedup the process of digital forensic triage. It uses Dissect to gather that information from the raw…
-
cuckoo-modified-api github.com
Python library to control a cuckoo-modified sandbox.
-
Digital Forensics Artifact Knowledge Base github.com
Digital Forensics Artifact Knowledge Base
- next page of items loading…
