APT-Hunter by ahmedkhlief

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

created at Dec. 26, 2020, 9:52 p.m.

Python

47 +0

1,255 +3

239 +1

GitHub
Zircolite by wagga40

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

created at March 2, 2021, 11:17 p.m.

Python

25 +0

680 +1

91 +0

GitHub
WELA by Yamato-Security

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅(ウェラ)

created at May 13, 2021, 10:33 p.m.

PowerShell

18 +0

763 +1

82 +0

GitHub
chainsaw by WithSecureLabs

Rapidly Search and Hunt through Windows Forensic Artefacts

created at Aug. 13, 2021, 1:07 p.m.

Rust

53 +0

2,876 +12

264 +0

GitHub
awesome-event-ids by stuhli

Collection of Event ID ressources useful for Digital Forensics and Incident Response

created at Sept. 22, 2021, 3:36 p.m.

Unknown languages

24 +0

586 +2

85 +0

GitHub
catalyst by SecurityBrewery

⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes

created at Dec. 12, 2021, 11:37 p.m.

Vue

7 +0

350 +4

37 +0

GitHub
iris-web by dfir-iris

Collaborative Incident Response platform

created at Dec. 20, 2021, 8:19 a.m.

JavaScript

28 +0

1,079 +5

184 +2

GitHub
mutablesecurity by MutableSecurity

CLI program for automating the setup, configuration, and use of cybersecurity solutions

created at March 15, 2022, 11:25 a.m.

Python

1 +0

43 +0

7 +0

GitHub
matano by matanolabs

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

created at July 3, 2022, 1:41 p.m.

Rust

22 +0

1,472 +8

100 +0

GitHub
acquire by fox-it

acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.

created at July 20, 2022, 1:09 p.m.

Python

15 +0

91 +0

26 +0

GitHub
dissect by fox-it

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

created at July 21, 2022, 8:26 a.m.

Unknown languages

22 +0

924 +3

65 +1

GitHub
dumpit-linux by MagnetForensics

Memory acquisition for Linux that makes sense.

created at Oct. 9, 2022, 7:49 p.m.

Rust

10 +0

155 +2

18 +0

GitHub
SOC-Multitool by zdhenard42

A powerful and user-friendly browser extension that streamlines investigations for security professionals.

created at Jan. 3, 2023, 4:51 p.m.

JavaScript

10 +0

338 +0

43 +0

GitHub
SPECTR3 by alpine-sec

Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.

created at May 4, 2023, 4:51 p.m.

C#

5 +0

37 +0

3 +0

GitHub