fsfang / DFIR-ToolkitLinks
This is a repo for cybersecurity analyst collecting artifacts in a incident response case.
☆17Updated 8 months ago
Alternatives and similar repositories for DFIR-Toolkit
Users that are interested in DFIR-Toolkit are comparing it to the libraries listed below
Sorting:
- Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR☆248Updated 6 months ago
- ☆160Updated last year
- Initial triage of Windows Event logs☆102Updated last year
- yara detection rules for hunting with the threathunting-keywords project☆151Updated 5 months ago
- PowerShell Script Analyzer☆70Updated last year
- ☆31Updated last year
- IOC Collection 2022☆57Updated 2 years ago
- Linux Evidence Acquisition Framework☆118Updated last year
- Lupo - Malware IOC Extractor. Debugging module for Malware Analysis Automation☆106Updated 3 years ago
- ShellSweeping the evil.☆180Updated 10 months ago
- ☆52Updated 2 months ago
- Linux Baseline and Forensic Triage Tool - BETA☆57Updated 3 years ago
- Sigma rules to share with the community☆122Updated 8 months ago
- Forensic Artifact Collection Tool Matrix☆91Updated 11 months ago
- CarbonBlack EDR detection rules and response actions☆72Updated last year
- Advanced Bash script designed for conducting digital forensics on Linux systems☆144Updated last year
- A ProcessMonitor visualization application written in rust.☆184Updated 2 years ago
- Automating EDR Testing with reference to MITRE ATTACK via Cobalt Strike [Purple Team].☆157Updated 2 years ago
- Active C&C Detector☆156Updated 2 years ago
- Volatility, on Docker 🐳☆39Updated 2 weeks ago
- A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.☆97Updated 2 years ago
- Helping Incident Responders hunt for potential persistence mechanisms on UNIX-based systems.☆17Updated last year
- Segugio allows the execution and tracking of critical steps in the malware detonation process, from clicking on the first stage to extrac…☆150Updated last year
- RegRipper4.0☆70Updated 2 months ago
- A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.☆159Updated 6 months ago
- ☆96Updated 5 months ago
- A running list of Windows sources and the related event ids.☆19Updated 2 years ago
- The LOLBins CTI-Driven (Living-Off-the-Land Binaries Cyber Threat Intelligence Driven) is a project that aims to help cyber defenders und…☆125Updated last year
- VTC - Velociraptor Timeline Creator☆18Updated last year
- Free training course offered at Hack Space Con 2023☆138Updated 2 years ago