meirwah/awesome-incident-response

ghidra by NationalSecurityAgency

Ghidra is a software reverse engineering (SRE) framework

created at March 1, 2019, 3:27 a.m.

Java

1,017 +4

47,537 +149

5,533 +16

GitHub

radare2 by radareorg

UNIX-like reverse engineering framework and command-line toolset

created at July 3, 2012, 7:42 a.m.

C

486 +0

19,600 +41

2,935 +3

GitHub

cutter by rizinorg

Free and Open Source Reverse Engineering Platform powered by rizin

created at Sept. 25, 2017, 9:50 a.m.

C++

299 +1

14,921 +42

1,121 -2

GitHub

atomic-red-team by redcanaryco

Small and highly portable detection tests based on MITRE's ATT&CK.

created at Oct. 11, 2017, 5:23 p.m.

C

343 +1

9,034 +40

2,657 +11

GitHub

sigma by SigmaHQ

Main Sigma Rule Repository

created at Dec. 24, 2016, 9:48 a.m.

Python

324 +0

7,604 +38

2,087 +3

GitHub

volatility by volatilityfoundation

An advanced memory forensics framework

created at April 24, 2014, 3:45 p.m.

Python

309 +0

6,917 +18

1,247 +2

GitHub

flare-vm by mandiant

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.

created at July 5, 2017, 9:17 p.m.

PowerShell

198 +2

5,844 +34

859 +2

GitHub

cuckoo by cuckoosandbox

Cuckoo Sandbox is an automated dynamic malware analysis system

created at Sept. 7, 2011, 12:12 p.m.

JavaScript

435 +0

5,407 +4

1,685 +1

GitHub

caldera by mitre

Automated Adversary Emulation Platform

created at Nov. 29, 2017, 1:25 a.m.

Python

167 -1

5,173 +16

1,007 +4

GitHub

grr by google

GRR Rapid Response: remote live forensics for incident response

created at Dec. 4, 2013, 12:17 a.m.

Python

316 +0

4,647 +2

759 +0

GitHub

sysmon-config by SwiftOnSecurity

Sysmon configuration file template with default high-quality event tracing

created at Feb. 1, 2017, 6:49 p.m.

Unknown languages

356 +0

4,566 +16

1,668 +1

GitHub

ThreatHunter-Playbook by OTRF

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

created at March 28, 2017, 3:07 a.m.

Python

370 +1

3,863 +40

792 +1

GitHub

capa by mandiant

The FLARE team's open-source tool to identify capabilities in executable files.

created at June 16, 2020, 9:24 p.m.

Python

78 +0

3,842 +12

492 +2

GitHub

HELK by Cyb3rWard0g

The Hunting ELK

created at March 14, 2017, 7:14 p.m.

Jupyter Notebook

216 +0

3,693 +4

672 +0

GitHub

awesome-forensics by cugu

A curated list of awesome forensic analysis tools and resources

created at March 29, 2016, 8:54 p.m.

Unknown languages

167 +1

3,571 +9

592 +1

GitHub

Loki by Neo23x0

Loki - Simple IOC and YARA Scanner

created at Jan. 18, 2015, 8:39 a.m.

Python

187 +0

3,219 +6

572 -1

GitHub

OSXAuditor by jipegit

OS X Auditor is a free Mac OS X computer forensics tool

created at June 19, 2013, 5:26 p.m.

JavaScript

184 +0

3,131 -1

282 +0

GitHub

security-onion by Security-Onion-Solutions

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management

created at March 24, 2015, 8:15 p.m.

Unknown languages

302 +0

3,057 +0

518 +0

GitHub

streamalert by airbnb

StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.

created at Jan. 22, 2017, 1:10 a.m.

Python

101 +0

2,828 +3

333 +0

GitHub

velociraptor by Velocidex

Digging Deeper....

created at March 24, 2018, 7:39 a.m.

Go

70 +0

2,648 +9

446 +2

GitHub