Remote Memory Acquisition Tool
created at Aug. 9, 2016, 5:39 p.m.
A simple many-rules to many-files YARA scanner for incident response or malware zoos.
created at May 3, 2018, 11:49 a.m.
StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
created at Jan. 22, 2017, 1:10 a.m.
Investigate suspicious activity by visualizing Sysmon's event log
created at July 31, 2018, 11:25 p.m.
Ghidra is a software reverse engineering (SRE) framework
created at March 1, 2019, 3:27 a.m.
DPS' Lightweight Investigation Notebook
created at Aug. 24, 2015, 2:53 p.m.
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
created at Feb. 8, 2018, 11:30 a.m.
Volatility plugin for extracts configuration data of known malware
created at April 22, 2019, 12:23 a.m.
PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.
created at Sept. 14, 2017, 9:15 a.m.
A collective list of public APIs for use in security. Contributions welcome
created at Jan. 9, 2018, 7:58 p.m.
"Evolving AppCompat/AmCache data analysis beyond grep"
created at April 2, 2017, 6:11 p.m.
🧠The artifactcollector is a customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
created at Jan. 3, 2020, 3:16 p.m.