Alternatives and similar repositories for dfir-orc-config

Users that are interested in dfir-orc-config are comparing it to the libraries listed below

• ANSSI-FR / bits_parser
  Extract BITS jobs from QMGR queue and store them as CSV records
  ☆75Updated 3 months ago
• airbus-cert / Splunk-ETW
  A Splunk Technology Add-on to forward filtered ETW events.
  ☆30Updated 4 years ago
• schrodyn / steezy
  Steezy - Ghetto Yara Generation
  ☆15Updated 2 years ago
• CERT-Polska / training-mwdb
  MWDB exercises
  ☆19Updated 3 months ago
• ernw / quarantine-formats
  Documentation and parsers for different anti-virus quarantine formats.
  ☆42Updated 4 years ago
• 00010111 / smbtimeline
  ☆34Updated 6 months ago
• avast / yarang
  Alternative YARA scanning engine
  ☆70Updated 2 years ago
• monnappa22 / Psinfo
  Psinfo is a Volatility plugin which collects the process related information from the VAD (Virtual Address Descriptor) and PEB (Process E…
  ☆36Updated 8 years ago
• certsocietegenerale / fame_modules
  Community modules for FAME
  ☆65Updated 3 months ago
• mandiant / apooxml
  Generate YARA rules for OOXML documents.
  ☆38Updated last year
• myrtus0x0 / SMAT
  Standardized Malware Analysis Tool
  ☆52Updated 4 years ago
• mandiant / goauditparser
  ☆45Updated last year
• openrelik / openrelik-server
  The core backend server handling API requests and task management
  ☆39Updated this week
• humpalum / vscode-sigma
  ☆16Updated last month
• IceMoonHSV / Sim
  C# User Simulation
  ☆32Updated 2 years ago
• W3ndige / aurora
  Malware similarity platform with modularity in mind.
  ☆78Updated 3 years ago
• forensiclunch / ETLParser
  Binary commandline executable to parse ETL files
  ☆67Updated 6 years ago
• Beercow / SEPparser
  Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.
  ☆64Updated 2 years ago
• ruppde / yara_rules
  Yara rules
  ☆21Updated 2 years ago
• hvs-consulting / ioc_signatures
  Repository with selected IOCs and YARA rules for threat hunting.
  ☆35Updated 4 months ago
• hpthreatresearch / tools
  Scripts and tools accompanying HP Threat Research blog posts and reports.
  ☆50Updated last year
• alwashmi / MasterParser
  MasterParser is a simple, all-in-one, digital forensics artifact parser
  ☆22Updated 3 years ago
• woanware / wmi-parser
  Parses the WMI object database....looking for persistence
  ☆31Updated 5 years ago
• DFIR-ORC / dfir-orc.github.io
  Documentation for DFIR ORC, artefact collection tool dedicated to Microsoft Windows
  ☆12Updated last month
• 3c7 / yaramanager
  Simple yara rule manager
  ☆66Updated 2 years ago
• msuhanov / winmem_decompress
  Extract compressed memory pages from page-aligned data
  ☆45Updated 6 years ago
• accidentalrebel / mbcscan
  Scans a malware file and lists down the related MBC (Malware Behavior Catalog) details.
  ☆22Updated 2 years ago
• malpedia / malpedia-flossed
  FLARE floss applied to all unpacked+dumped samples in Malpedia, pre-processed for further use.
  ☆50Updated 2 months ago
• woanware / etw-event-dumper
  ☆33Updated 3 years ago
• Neo23x0 / sysmon-version-history
  An Inofficial Sysmon Version History (Change Log)
  ☆32Updated 4 years ago