xophidia / DFIR_Linux_Collector
The Linux DFIR Collector is a stand-alone collection tool for Gnu / Linux. Dump artifacts in json format with very few impacts on the host system. Created for incident response Team.
☆29Updated 2 years ago
Related projects ⓘ
Alternatives and complementary repositories for DFIR_Linux_Collector
- A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.☆94Updated last year
- YARA rule analyzer to improve rule quality and performance☆93Updated 11 months ago
- JPCERT/CC public YARA rules repository☆103Updated 5 months ago
- ☆61Updated last month
- A repository hosting example goodware evtx logs containing sample software installation and basic user interaction☆68Updated last year
- Memory Baseliner is a script that can compare two windows memory images or perform frequency of occurrence / data stacking analysis on mu…☆49Updated last year
- Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)☆67Updated last year
- 100 Days of YARA to be updated with rules & ideas as the year progresses☆56Updated last year
- IOC Collection 2022☆55Updated last year
- Initial triage of Windows Event logs☆89Updated 5 months ago
- ☆57Updated 3 weeks ago
- A specification and style guide for YARA rules☆37Updated 9 months ago
- ☆85Updated 9 months ago
- ☆36Updated 3 years ago
- Detection Engineering with YARA☆85Updated 10 months ago
- Active C&C Detector☆150Updated last year
- Project based on RegRipper, to extract add'l value/pivot points from TLN events file☆76Updated last week
- Sigma rules to share with the community☆115Updated 2 months ago
- A Cobalt Strike Scanner that retrieves detected Team Server beacons into a JSON object☆164Updated 2 years ago
- Rules Shared by the Community from 100 Days of YARA 2023☆78Updated last year
- ☆1Updated 3 weeks ago
- CarbonBlack EDR detection rules and response actions☆71Updated 2 months ago
- Jupyter Notebooks for Cyber Threat Intelligence☆35Updated last year
- Scripts and tools accompanying HP Threat Research blog posts and reports.☆49Updated 7 months ago
- Harness the power of Splunk for your investigations☆77Updated this week
- Contains compiled binaries of Volatility☆29Updated last month
- Elastic Security Labs releases☆52Updated 3 weeks ago
- A repository to share publicly available Velociraptor detection content☆119Updated this week
- Forensics scripts aimed at automating & enhancing the Forensics Legend Eric Zimmerman's techniques, integrating the statistical detection…☆16Updated last year
- USN Journal full path builder☆36Updated 2 months ago