Alternatives and similar repositories for WAAD

Users that are interested in WAAD are comparing it to the libraries listed below

• ANSSI-FR / bits_parser
  Extract BITS jobs from QMGR queue and store them as CSV records
  ☆73Updated 11 months ago
• imp0rtp3 / Yobi
  Yara Based Detection Engine for web browsers
  ☆49Updated 4 years ago
• DFIR-ORC / dfir-orc-config
  Configurations for DFIR ORC
  ☆28Updated last year
• swisscom / PowerSponse
  PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.
  ☆40Updated 3 years ago
• Silv3rHorn / evtx2json
  evtx2json extracts events of interest from event logs, dedups them, and exports them to json.
  ☆41Updated 4 years ago
• NextronSystems / valhallaAPI
  Valhalla API Client
  ☆70Updated 3 weeks ago
• sbousseaden / YaraHunts
  Random hunting ordiented yara rules
  ☆98Updated 2 years ago
• jschicht / SetMace
  Manipulate timestamps on NTFS
  ☆52Updated 11 years ago
• mandiant / goauditparser
  ☆46Updated 2 years ago
• andreafortuna / autotimeliner
  Automagically extract forensic timeline from volatile memory dump
  ☆132Updated last year
• mnrkbys / vss_carver
  Carves and recreates VSS catalog and store from Windows disk image.
  ☆100Updated 3 years ago
• airbus-cert / Splunk-ETW
  A Splunk Technology Add-on to forward filtered ETW events.
  ☆30Updated 5 years ago
• mkorman90 / sysmon-config-bypass-finder
  Detect possible sysmon logging bypasses given a specific configuration
  ☆111Updated 7 years ago
• myrtus0x0 / SMAT
  Standardized Malware Analysis Tool
  ☆56Updated 4 years ago
• W3ndige / aurora
  Malware similarity platform with modularity in mind.
  ☆80Updated 4 years ago
• Neo23x0 / panopticon
  A YARA Rule Performance Measurement Tool
  ☆61Updated last year
• Neo23x0 / xorex
  XOR Key Extractor
  ☆51Updated last year
• moullos / Mitigate
  Machine Interrogation To Identify Gaps & Techniques for Execution
  ☆33Updated 3 years ago
• deadbits / yara-rules
  Collection of YARA signatures from individual research
  ☆45Updated 2 years ago
• sumeshi / evtx2es
  A library for fast parse & import of Windows Eventlogs into Elasticsearch.
  ☆86Updated 7 months ago
• olafhartong / Presentations
  My conference presentations
  ☆87Updated 3 months ago
• hpthreatresearch / tools
  Scripts and tools accompanying HP Threat Research blog posts and reports.
  ☆50Updated last year
• CIRCL / factual-rules-generator
  Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a machine.
  ☆75Updated 4 years ago
• airbus-cert / timeliner
  A rewrite of mactime, a bodyfile reader
  ☆39Updated last year
• AndrewRathbun / Anti-Forensics-VHDX
  A sample VHDX file with multiple verbose examples of forensic and anti-forensics artifacts. Meant to be basic and can be expanded upon. P…
  ☆27Updated 3 years ago
• jwillyamz / ezEmu
  See adversary, do adversary: Simple execution of commands for defensive tuning/research (now with more ELF on the shelf)
  ☆107Updated 3 years ago
• IllusiveNetworks-Labs / HistoricProcessTree
  An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree…
  ☆60Updated 8 years ago
• swimlane / PSAttck
  PSAttck is a light-weight framework for the MITRE ATT&CK Framework.
  ☆38Updated 4 years ago
• Beercow / SEPparser
  Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.
  ☆64Updated 3 years ago
• nidem / forgedpillow
  A tool to modify timestamps in a packet capture to a user selected date
  ☆31Updated 4 years ago