google / GiftStick
1-Click push forensics evidence to the cloud
☆137Updated 2 months ago
Related projects: ⓘ
- Invoke-LiveResponse☆145Updated 2 years ago
- Tools to assist in forensicating docker☆77Updated 11 months ago
- A modern Python-3-based alternative to RegRipper☆184Updated 11 months ago
- Automatically create YARA rules from malicious documents.☆207Updated 2 years ago
- Salt States for Configuring the SIFT Workstation☆93Updated this week
- The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted driv…☆332Updated 2 years ago
- Extract common Windows artifacts from source images and VSCs☆65Updated 3 years ago
- InvestigationPlaybookSpec☆72Updated 6 years ago
- Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The…☆175Updated 3 years ago
- Yara-Endpoint is a tool useful for incident response as well as anti-malware enpoint base on Yara signatures.☆102Updated 6 years ago
- Tools to automate and/or expedite response.☆113Updated 2 months ago
- Extension to Cuckoo Sandbox open source projects, adds support to AWS cloud functionalities and enables running emulation on auto-scaling…☆134Updated 2 years ago
- Tools for the Computer Incident Response Team☆141Updated 7 years ago
- PowerShell No Agent Hunting☆107Updated 6 years ago
- Different DFIR and CTI utilities☆35Updated 4 years ago
- Windows Live Artifacts Acquisition Script☆181Updated 2 years ago
- A rewrite of mactime, a bodyfile reader☆33Updated last month
- Please use https://github.com/veeral-patel/true-positive instead☆65Updated last year
- Main Build directory☆176Updated 5 years ago
- A collection of typical false positive indicators☆54Updated 3 years ago
- Yet another registry parser☆128Updated 2 years ago
- Security Monitoring Resolution Categories☆138Updated 2 years ago
- stoQ Public Plugins☆71Updated last year
- Lists of sources and utilities utilized to hunt, detect and prevent evildoers.☆158Updated 5 years ago
- Checks with NSRL RDS servers looking for for hash matches☆111Updated 3 years ago
- Community modules for FAME☆63Updated 2 weeks ago
- A collection of notebooks built for defensive and offensive operations.☆76Updated 3 years ago
- All the IOC's I have gathered which are used directly involved coronavirus / covid-19 / SARS-CoV-2 cyber attack campaigns☆65Updated 3 years ago
- Identifies physical locations where a laptop has been based upon wireless profiles and wireless data recorded in event logs☆89Updated 3 years ago
- Scripts to facilitate filtering with Plaso☆124Updated 4 years ago