travisfoley / dfirtriage
Digital forensic acquisition tool for Windows based incident response.
☆337Updated 9 months ago
Alternatives and similar repositories for dfirtriage:
Users that are interested in dfirtriage are comparing it to the libraries listed below
- Tool Analysis Result Sheet☆347Updated 7 years ago
- ☆348Updated 3 years ago
- Test Blue Team detections without running any attack.☆272Updated 9 months ago
- A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.☆442Updated 3 months ago
- ☆274Updated last year
- ☆297Updated 4 years ago
- A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework☆350Updated 4 years ago
- Collecting & Hunting for IOCs with gusto and style☆236Updated 3 years ago
- A PowerShell script to interact with the MITRE ATT&CK Framework via its own API☆367Updated 6 years ago
- A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.☆476Updated 3 years ago
- Powershell Threat Hunting Module☆282Updated 8 years ago
- MITRE ATT&CK Windows Logging Cheat Sheets☆334Updated 6 years ago
- PCAP Samples for Different Post Exploitation Techniques☆352Updated 3 years ago
- Investigate suspicious activity by visualizing Sysmon's event log☆419Updated last year
- Misc Threat Hunting Resources☆373Updated 2 years ago
- ATT&CK Remote Threat Hunting Incident Response☆199Updated 2 months ago
- Code and yara rules to detect and analyze Cobalt Strike☆265Updated 3 years ago
- Live forensic artifacts collector☆164Updated 7 months ago
- ☆116Updated last year
- Awesome VirusTotal Intelligence Search Queries☆332Updated last year
- IOC from articles, tweets for archives☆313Updated last year
- Searches For Threat Hunting and Security Analytics☆240Updated 3 years ago
- Detecting ATT&CK techniques & tactics for Linux☆258Updated 4 years ago
- Personal compilation of APT malware from whitepaper releases, documents and own research☆259Updated 6 years ago
- Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-Cradle…☆296Updated 3 years ago
- Data from a BRAWL Automated Adversary Emulation Exercise☆204Updated 4 years ago
- ☆160Updated 4 years ago
- Sigma rules from Joe Security☆206Updated 3 months ago
- A repo containing tools developed by Carbon Black's Threat Research Team: Threat Analysis Unit☆233Updated 3 years ago
- This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole …☆198Updated 4 years ago