The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts that may no longer be readily available anymore.
☆667Oct 24, 2026Updated last week
Alternatives and similar repositories for DFIRArtifactMuseum
Users that are interested in DFIRArtifactMuseum are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare …☆208Oct 29, 2025Updated last year
- UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It …☆1,507Oct 26, 2026Updated last week
- The official repo for a project involving a crowdsourced DFIR book. The main purpose of this book is to give anyone interested an opportu…☆225Dec 30, 2025Updated 10 months ago
- MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR☆743Aug 31, 2026Updated 2 months ago
- Collection of Event ID ressources useful for Digital Forensics and Incident Response☆664Jun 19, 2024Updated 2 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Digital Forensics artifact repository☆1,284Updated this week
- A repository of DFIR-related Mind Maps geared towards the visual learners!☆554Sep 2, 2022Updated 4 years ago
- A python script developed to process Windows memory images based on triage type.☆268Nov 25, 2023Updated 2 years ago
- Rapidly Search and Hunt through Windows Forensic Artefacts☆3,707Oct 14, 2026Updated 3 weeks ago
- A curated list of KAPE-related resources☆193May 1, 2025Updated last year
- Documentation and scripts to properly enable Windows event logs.☆724Oct 3, 2025Updated last year
- An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.☆347Dec 3, 2025Updated 11 months ago
- Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders☆1,086Oct 5, 2023Updated 3 years ago
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆873Updated this week
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Practical Windows Forensics Training☆790Feb 16, 2026Updated 8 months ago
- Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.☆3,436Updated this week
- Event Tracing For Windows (ETW) Resources☆440Sep 25, 2026Updated last month
- A repo to centralize some of the regular expressions I've found useful over the course of my DFIR career.☆109Mar 12, 2026Updated 7 months ago
- Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts…☆1,181Updated this week
- Windows Events Attack Samples☆2,641Jan 24, 2023Updated 3 years ago
- A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.☆120Jan 26, 2022Updated 4 years ago
- A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.☆867Jun 29, 2026Updated 4 months ago
- Digital Forensics Investigation Platform☆915Oct 12, 2024Updated 2 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- This repository serves as a place for community created Targets and Modules for use with KAPE.☆894Updated this week
- Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.☆646May 21, 2026Updated 5 months ago
- A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as …☆475Feb 18, 2026Updated 8 months ago
- Everything related to Linux Forensics☆733Jul 13, 2023Updated 3 years ago
- DFIQ is a collection of investigative questions and the approaches for answering them☆318Mar 10, 2026Updated 7 months ago
- Collaborative forensic timeline analysis☆3,447Updated this week
- A list of cyber-chef recipes and curated links☆2,226Jun 14, 2024Updated 2 years ago
- Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)☆70Sep 13, 2023Updated 3 years ago
- Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detection…☆872Jan 20, 2022Updated 4 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of eve…☆53Oct 29, 2025Updated last year
- $MFT directory tree reconstruction & FILE record info☆334Oct 7, 2024Updated 2 years ago
- Public script from SANS FOR509 Enterprise Cloud Incident Response☆242Oct 26, 2025Updated last year
- CLI tools for forensic investigation of Windows artifacts☆356Jul 21, 2025Updated last year
- Super timeline all the things☆2,186Updated this week
- ☆2,443Oct 14, 2023Updated 3 years ago
- Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).☆831Oct 21, 2026Updated 2 weeks ago