fsfang / DFIR-ToolkitLinks
This is a repo for cybersecurity analyst collecting artifacts in a incident response case.
☆18Updated 8 months ago
Alternatives and similar repositories for DFIR-Toolkit
Users that are interested in DFIR-Toolkit are comparing it to the libraries listed below
Sorting:
- Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR☆248Updated last week
- ShellSweeping the evil.☆181Updated 11 months ago
- yara detection rules for hunting with the threathunting-keywords project☆152Updated 5 months ago
- ☆160Updated last year
- Initial triage of Windows Event logs☆102Updated last year
- Advanced Bash script designed for conducting digital forensics on Linux systems☆145Updated last year
- Linux Evidence Acquisition Framework☆118Updated last year
- PowerShell Script Analyzer☆70Updated 2 years ago
- Lupo - Malware IOC Extractor. Debugging module for Malware Analysis Automation☆106Updated 3 years ago
- ☆52Updated 2 months ago
- ☆32Updated last year
- RegRipper4.0☆73Updated 2 months ago
- Helping Incident Responders hunt for potential persistence mechanisms on UNIX-based systems.☆17Updated 2 years ago
- IOC Collection 2022☆57Updated 2 years ago
- The LOLBins CTI-Driven (Living-Off-the-Land Binaries Cyber Threat Intelligence Driven) is a project that aims to help cyber defenders und…☆125Updated last year
- Linux Baseline and Forensic Triage Tool - BETA☆57Updated 3 years ago
- Segugio allows the execution and tracking of critical steps in the malware detonation process, from clicking on the first stage to extrac…☆149Updated last year
- Packet captures of malicious traffic for analysis using Wireshark☆62Updated 2 years ago
- Really can protect from ransomware encryption?☆46Updated last year
- Forensic Artifact Collection Tool Matrix☆91Updated last year
- Volatility, on Docker 🐳☆40Updated 3 weeks ago
- CarbonBlack EDR detection rules and response actions☆73Updated last year
- Free training course offered at Hack Space Con 2023☆139Updated 2 years ago
- A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.☆97Updated 2 years ago
- Detection Engineering with YARA☆87Updated last year
- Automating EDR Testing with reference to MITRE ATTACK via Cobalt Strike [Purple Team].☆157Updated 2 years ago
- Rapid7 Labs operates as the division of Rapid7 focused on threat research. It is renowned for providing comprehensive threat intelligence…☆73Updated 4 months ago
- ☆195Updated last year
- ThreatSeeker: Threat Hunting via Windows Event Logs☆123Updated 2 years ago
- 🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections.☆79Updated 6 months ago