ANSSI-FR / DECODELinks
Malware detection tool for Windows PE files based on DFIR ORC data
☆10Updated 5 months ago
Alternatives and similar repositories for DECODE
Users that are interested in DECODE are comparing it to the libraries listed below
Sorting:
- FJTA (Forensic Journal Timeline Analyzer) is a tool that analyzes Linux filesystem (ext4, XFS) journals (not systemd-journald logs), gene…☆103Updated 3 weeks ago
- Automated YARA Rule Standardization and Quality Assurance Tool☆278Updated last week
- The backend server handling API requests and task management☆55Updated this week
- Segugio allows the execution and tracking of critical steps in the malware detonation process, from clicking on the first stage to extrac…☆151Updated last year
- acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.☆117Updated 3 weeks ago
- Memory Baseliner is a script that can compare two windows memory images or perform frequency of occurrence / data stacking analysis on mu…☆55Updated 2 years ago
- ☆152Updated 3 months ago
- A guide on how to write fast and memory friendly YARA rules☆164Updated 11 months ago
- A specification and style guide for YARA rules☆66Updated last year
- Rules shared by the community from 100 Days of YARA 2024☆89Updated last year
- Convert Sigma rules to SIEM queries, directly in your browser.☆109Updated 2 weeks ago
- Elastic Security Labs releases☆84Updated 2 months ago
- A toolkit for the post-mortem examination of Docker containers from forensic HDD copies☆108Updated last year
- Rules Shared by the Community from 100 Days of YARA 2023☆78Updated 2 years ago
- A YARA & Malware Analysis Toolkit written in Rust.☆92Updated this week
- A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you com…☆180Updated 8 months ago
- orc2timeline extracts and analyzes artifacts contained in archives generated with DFIR-ORC.exe to create a timeline from them☆34Updated 7 months ago
- ☆57Updated last month
- YARA rule analyzer to improve rule quality and performance☆110Updated 3 weeks ago
- This repository contains helper scripts and custom configs to get the best out of Google's Timesketch project.☆118Updated 2 years ago
- A forensic open-source parser module for Autopsy that allows extracting the messages, comments, posts, contacts, calendar entries and rea…☆115Updated 3 weeks ago
- Rules shared by the community from 100 Days of YARA 2025☆38Updated last month
- A repository to share publicly available Velociraptor detection content☆196Updated this week
- A python script developed to process Windows memory images based on triage type.☆263Updated 2 years ago
- Outil de triage automatisé de différents types de collectes d'artefacts.☆17Updated 2 months ago
- Harness the power of Splunk for your investigations☆149Updated 3 months ago
- A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.☆162Updated 10 months ago
- The Volatility Collaborative GUI☆266Updated this week
- Memory acquisition for Linux that makes sense.☆219Updated 2 years ago
- Project based on RegRipper, to extract add'l value/pivot points from TLN events file☆89Updated last year