meirwah/awesome-incident-response

mac_apt by ydkhatri

macOS (& ios) Artifact Parsing Tool

created at Aug. 24, 2017, 3:37 p.m.

Python

44 +0

782 +2

102 +2

GitHub

Raccine by Neo23x0

A Simple Ransomware Vaccine

created at Oct. 3, 2020, 11:30 a.m.

C++

43 +0

944 +0

122 +0

GitHub

SysmonSearch by JPCERTCC

Investigate suspicious activity by visualizing Sysmon's event log

created at July 31, 2018, 11:25 p.m.

JavaScript

43 +0

417 +0

58 +0

GitHub

hayabusa by Yamato-Security

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

created at Sept. 18, 2020, 5:04 a.m.

Rust

42 +1

2,305 +15

203 +0

GitHub

lorg by jensvoid

Apache Logfile Security Analyzer

created at June 20, 2013, 6:33 p.m.

HTML

42 +0

209 +0

50 +0

GitHub

Aurora-Incident-Response by cyb3rfox

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders

created at June 9, 2020, 12:12 p.m.

JavaScript

42 +0

766 +1

81 +0

GitHub

munin by Neo23x0

Online hash checker for Virustotal and other services

created at Oct. 9, 2017, 11:04 a.m.

Python

42 +0

809 +1

147 +1

GitHub

Shuffle by Shuffle

Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

created at May 7, 2020, 12:28 p.m.

Shell

41 +0

1,743 +4

336 +0

GitHub

Fenrir by Neo23x0

Simple Bash IOC Scanner

created at Oct. 8, 2015, 3:55 a.m.

Shell

41 +0

697 +3

103 +0

GitHub

Skadi by orlikoski

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

created at Oct. 25, 2016, 2:57 p.m.

Shell

38 +0

491 +0

70 +0

GitHub

evolve by JamesHabben

Web interface for the Volatility Memory Forensics Framework

created at April 14, 2015, 1:26 a.m.

JavaScript

38 +0

259 +0

42 +0

GitHub

scot by sandialabs

Sandia Cyber Omni Tracker (SCOT)

created at Aug. 27, 2014, 8:24 p.m.

JavaScript

37 +0

245 +0

48 +0

GitHub

fleet by fleetdm

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)

created at Nov. 3, 2020, 10:17 p.m.

Go

36 +2

3,119 +12

431 +4

GitHub

MalConfScan by JPCERTCC

Volatility plugin for extracts configuration data of known malware

created at April 22, 2019, 12:23 a.m.

Python

36 +0

485 +2

67 +0

GitHub

flightsim by alphasoc

A utility to safely generate malicious network traffic patterns and evaluate controls.

created at Jan. 10, 2018, 12:31 p.m.

Go

35 +0

1,260 +3

132 +0

GitHub

falcon-orchestrator by CrowdStrike

CrowdStrike Falcon Orchestrator provides automated workflow and response capabilities

created at April 22, 2016, 1:25 a.m.

JavaScript

35 +0

186 +0

54 +0

GitHub

Kuiper by DFIRKuiper

Digital Forensics Investigation Platform

created at Nov. 1, 2019, 4:45 a.m.

JavaScript

34 +0

769 +1

111 +0

GitHub

doorman by mwielgoszewski

an osquery fleet manager

created at April 22, 2016, 7:31 p.m.

Python

33 +0

621 +1

90 +0

GitHub

avml by Microsoft

AVML - Acquire Volatile Memory for Linux

created at June 6, 2019, 11:01 p.m.

Rust

32 +0

875 +1

76 +0

GitHub

zentral by zentralopensource

Zentral is a high-visibility platform for controlling Apple endpoints in enterprises. It brings great observability to IT and makes tracking & reporting compliance much less manual.

created at Oct. 20, 2015, 2:03 p.m.

Python

32 +0

752 +1

82 +0

GitHub