gajos112 / Digital-Forensics
☆35Updated 3 years ago
Related projects: ⓘ
- Scripts and tools accompanying HP Threat Research blog posts and reports.☆48Updated 5 months ago
- Memory Baseliner is a script that can compare two windows memory images or perform frequency of occurrence / data stacking analysis on mu…☆47Updated last year
- A repository hosting example goodware evtx logs containing sample software installation and basic user interaction☆66Updated 9 months ago
- A repo for centralizing ongoing research on the new Windows 10/11 DFIR artifact, EventTranscript.db.☆38Updated 2 years ago
- ☆20Updated 2 years ago
- Placeholder for my detection repo and misc detection engineering content☆43Updated 10 months ago
- ESXi Cyber Security Incident Response Script☆19Updated 2 weeks ago
- USN Journal full path builder☆36Updated this week
- ☆19Updated last year
- ☆84Updated 7 months ago
- An exercise to practice deobfuscating PowerShell Scripts.☆27Updated last year
- PowerShell scripts for running Magnet RESPONSE forensic collection tool in large enterprises.☆20Updated 4 months ago
- Simple PowerShell script to enable process scanning with Yara.☆86Updated last year
- Collection of scripts provided for public use☆28Updated last month
- Hunt malware with Volatility☆46Updated 4 months ago
- 100 Days of YARA to be updated with rules & ideas as the year progresses☆57Updated last year
- An experimental script to perform bulk parsing of arbitrary file features with YARA and console logging.☆21Updated last year
- Logbook for Digital Forensics and Incident Response☆48Updated 2 months ago
- Get-MiniTimeline - Triage Collection and Timeline Generation w/ KAPE☆25Updated 3 months ago
- Manipulate timestamps on NTFS☆48Updated 9 years ago
- Library of threat hunts to get any user started!☆40Updated 4 years ago
- The Linux DFIR Collector is a stand-alone collection tool for Gnu / Linux. Dump artifacts in json format with very few impacts on the hos…☆29Updated 2 years ago
- Parses USB connection artifacts from offline Registry hives☆50Updated last week
- Jupyter Notebooks for Cyber Threat Intelligence☆35Updated last year
- Script to automate Linux live evidence collection☆27Updated 2 years ago
- Carve file metadata from NTFS index ($I30) attributes☆58Updated 7 months ago
- Random notes collected on the intertubes relating to DFIR☆32Updated last year
- ShellSweeping the evil.☆49Updated 3 months ago
- Rhaegal is a tool written in Python 3 used to scan Windows Event Logs for suspicious logs. Rhaegal uses custom rule format to detect sus…☆39Updated 11 months ago