Zircolite by wagga40

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

created at March 2, 2021, 11:17 p.m.

Python

25 +0

680 +1

91 +0

GitHub
dfir-orc by DFIR-ORC

Forensics artefact collection tool for systems running Microsoft Windows

created at Sept. 20, 2019, 9:30 a.m.

C++

26 -1

387 +1

42 +0

GitHub
RegRipper3.0 by keydet89

RegRipper3.0

created at May 27, 2020, 3:24 p.m.

Perl

26 +0

557 +3

126 +3

GitHub
VolatilityBot by mkorman90

VolatilityBot – An automated memory analyzer for malware samples and memory dumps

created at Feb. 4, 2015, 3:13 p.m.

Python

27 +0

263 +0

59 +0

GitHub
dftimewolf by log2timeline

A framework for orchestrating forensic collection, processing and data export

created at July 29, 2016, 1:54 p.m.

Python

27 +0

296 -1

72 +0

GitHub
uac by tclahr

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

created at Jan. 8, 2020, 5:19 p.m.

Shell

28 +0

797 +3

124 +0

GitHub
iris-web by dfir-iris

Collaborative Incident Response platform

created at Dec. 20, 2021, 8:19 a.m.

JavaScript

28 +0

1,079 +5

184 +2

GitHub
VolDiff by aim4r

VolDiff: Malware Memory Footprint Analysis based on Volatility

created at April 19, 2015, 12:30 a.m.

Python

28 +0

193 +1

50 +0

GitHub
stringsifter by mandiant

A machine learning tool that ranks strings based on their relevance for malware analysis.

created at Sept. 5, 2019, 1:02 p.m.

Python

29 +0

681 +2

125 +0

GitHub
CDQR by orlikoski

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices

created at Jan. 14, 2016, 4:48 p.m.

Python

30 +0

334 +0

50 +0

GitHub
hostintel by keithjjones

A modular Python application to collect intelligence for malicious hosts.

created at Aug. 22, 2016, 8:25 p.m.

Python

30 +0

262 +0

51 +0

GitHub
inVtero.net by ShaneK2

inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

created at April 29, 2011, 4:37 a.m.

C#

30 +0

279 +1

57 +0

GitHub
Meerkat by TonyPhipps

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

created at Feb. 8, 2018, 11:30 a.m.

PowerShell

31 +0

435 +0

82 +0

GitHub
avml by Microsoft

AVML - Acquire Volatile Memory for Linux

created at June 6, 2019, 11:01 p.m.

Rust

32 +0

875 +1

76 +0

GitHub
CyLR by orlikoski

CyLR - Live Response Collection Tool

created at Sept. 6, 2016, 10:14 p.m.

C#

32 +0

645 +3

88 -1

GitHub
zentral by zentralopensource

Zentral is a high-visibility platform for controlling Apple endpoints in enterprises. It brings great observability to IT and makes tracking & reporting compliance much less manual.

created at Oct. 20, 2015, 2:03 p.m.

Python

32 +0

752 +1

82 +0

GitHub
doorman by mwielgoszewski

an osquery fleet manager

created at April 22, 2016, 7:31 p.m.

Python

33 +0

621 +1

90 +0

GitHub
Kuiper by DFIRKuiper

Digital Forensics Investigation Platform

created at Nov. 1, 2019, 4:45 a.m.

JavaScript

34 +0

769 +1

111 +0

GitHub
flightsim by alphasoc

A utility to safely generate malicious network traffic patterns and evaluate controls.

created at Jan. 10, 2018, 12:31 p.m.

Go

35 +0

1,260 +3

132 +0

GitHub
falcon-orchestrator by CrowdStrike

CrowdStrike Falcon Orchestrator provides automated workflow and response capabilities

created at April 22, 2016, 1:25 a.m.

JavaScript

35 +0

186 +0

54 +0

GitHub