Incident response teams usually working on the offline data, collecting the evidence, then analyze the data
☆48Jan 2, 2022Updated 4 years ago
Alternatives and similar repositories for DFIR
Users that are interested in DFIR are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Quick lookup files for SUNBURST Backdoor☆12Dec 15, 2020Updated 5 years ago
- MasterParser is a simple, all-in-one, digital forensics artifact parser☆24Jul 9, 2021Updated 5 years ago
- Invoke-Forensics provides PowerShell commands to simplify working with the forensic tools KAPE and RegRipper.☆119Nov 28, 2023Updated 2 years ago
- Vagrant Files to create a Virtualbox VM for Malware Analysis☆13Jun 1, 2021Updated 5 years ago
- Basic c2-matrix analysis enviroment using Suricata + Wazuh + Elastic stack☆13Apr 18, 2020Updated 6 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- Menu for Thor scanner lite☆20Oct 24, 2025Updated last year
- Incident Response Methodologies (IRM), also called Incident Playbook, based on the work done by the CERT Societe General☆24Dec 16, 2021Updated 4 years ago
- Detects and reports malicious clipboard content (PowerShell, mshta, etc.) on any page, with user alerts.☆16Oct 5, 2025Updated last year
- Notes on managing and coordinating the response to major cyber incidents☆41May 30, 2020Updated 6 years ago
- A collection of Cortex Analyzers and Responders for TheHive/Cortex☆13Jan 29, 2020Updated 6 years ago
- Linux Baseline and Forensic Triage Tool - BETA☆63Mar 10, 2026Updated 7 months ago
- Repository for different Windows DFIR related CMDs, PowerShell CMDlets, etc, plus workshops that I did for different conferences or event…☆76Jul 13, 2021Updated 5 years ago
- Track progress and keep notes while working through likethecoins' CTI Self Study Plan☆29Aug 25, 2022Updated 4 years ago
- A curated list of KAPE-related resources☆193May 1, 2025Updated last year
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- Tools and scripts to deploy and manage OpenRelik instances☆17Mar 23, 2026Updated 7 months ago
- Proof-of-concept automated baremetal malware analysis framework.☆14Sep 24, 2015Updated 11 years ago
- Push "BAD" IPs/Networks into QRadar's "Remote Networks", tag them properly, and use them!☆17Nov 5, 2013Updated 12 years ago
- Create dataset for suricata with indicators of MISP instances and add sightings in MISP if an indicator of dataset generates an alert☆37Nov 9, 2022Updated 3 years ago
- Scripts to integrate DFIR-IRIS, MISP and TimeSketch☆37Feb 2, 2022Updated 4 years ago
- Incident Response documents and tooling☆133Jul 22, 2026Updated 3 months ago
- SACTI - Securely aggregate CTI sightings and report them on MISP☆14Oct 24, 2022Updated 4 years ago
- Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.☆215Jul 21, 2022Updated 4 years ago
- An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.☆348Dec 3, 2025Updated 10 months ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Automated pipeline for generating forensic timelines from Magnet Response collections.☆15Nov 6, 2025Updated 11 months ago
- Detection Ideas & Rules repository.☆179Sep 10, 2021Updated 5 years ago
- A python script developed to process Windows memory images based on triage type.☆268Nov 25, 2023Updated 2 years ago
- This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole …☆217Oct 19, 2020Updated 6 years ago
- Digital Forensics Investigation Platform☆911Oct 12, 2024Updated 2 years ago
- Winterfell is a group of windows batch scripts to collect Windows forensics data and perform efficient, and fast incident response and th…☆52Jul 23, 2020Updated 6 years ago
- Automate forensic traige package collection and evidence parsing with KAPE and Crowdstrike☆15Mar 5, 2022Updated 4 years ago
- Jupyter Notebooks from Python as a Forensic Tool presentation☆11Feb 10, 2023Updated 3 years ago
- DFIRTrack - The Incident Response Tracking Application☆540Jan 13, 2026Updated 9 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"☆11Feb 6, 2025Updated last year
- Dump of organized knowledge on DFIR☆138Oct 4, 2021Updated 5 years ago
- Work in Progress repo☆16Apr 18, 2019Updated 7 years ago
- Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs☆54Jul 20, 2023Updated 3 years ago
- The "DFUR" Splunk application and data that was presented at the 2020 SANS DFIR Summit.☆13Sep 9, 2020Updated 6 years ago
- Windows 10 Live Information viewer☆40Jan 27, 2022Updated 4 years ago
- Resources for DFIR Professionals Responding to the Whispergate☆10Jan 17, 2022Updated 4 years ago