playbooks by phantomcyber

Phantom Community Playbooks

created at Aug. 31, 2015, 10:35 p.m.

Python

61 +0

456 +2

194 +1

GitHub
threat_note by DefensePointSecurity

DPS' Lightweight Investigation Notebook

created at Aug. 24, 2015, 2:53 p.m.

HTML

57 +0

423 +0

97 +0

GitHub
AChoir by OMENScan

Windows Live Artifacts Acquisition Script

created at May 25, 2015, 7:48 p.m.

C++

14 +0

177 +0

31 +0

GitHub
DidierStevensSuite by DidierStevens

Please no pull requests for this repository. Thanks!

created at May 8, 2015, 11:21 a.m.

Python

123 +1

1,879 +7

505 +1

GitHub
domfind by diogo-fernan

A Python DNS crawler to find identical domain names under different TLDs.

created at April 24, 2015, 10:18 a.m.

Python

4 +0

21 +0

3 +0

GitHub
VolDiff by aim4r

VolDiff: Malware Memory Footprint Analysis based on Volatility

created at April 19, 2015, 12:30 a.m.

Python

28 +0

192 +0

50 +0

GitHub
evolve by JamesHabben

Web interface for the Volatility Memory Forensics Framework

created at April 14, 2015, 1:26 a.m.

JavaScript

38 +0

259 +0

42 +0

GitHub
security-onion by Security-Onion-Solutions

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management

created at March 24, 2015, 8:15 p.m.

Unknown languages

301 +0

3,055 +0

518 +0

GitHub
PowerForensics by Invoke-IR

PowerForensics provides an all in one platform for live disk forensic analysis

created at March 7, 2015, 5:12 p.m.

C#

159 +0

1,369 +2

276 +0

GitHub
VolatilityBot by mkorman90

VolatilityBot – An automated memory analyzer for malware samples and memory dumps

created at Feb. 4, 2015, 3:13 p.m.

Python

27 +0

261 +1

59 +0

GitHub
Loki by Neo23x0

Loki - Simple IOC and YARA Scanner

created at Jan. 18, 2015, 8:39 a.m.

Python

186 +0

3,271 +5

575 +1

GitHub
artifacts by ForensicArtifacts

Digital Forensics artifact repository

created at Oct. 31, 2014, 7:13 p.m.

Python

73 +0

998 +1

203 +0

GitHub
stenographer by google

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com

created at Oct. 13, 2014, 9:26 p.m.

Go

104 +0

1,789 +0

234 +0

GitHub
winreg-kb by libyal

Windows Registry Knowledge Base

created at Sept. 28, 2014, 5:15 a.m.

Python

16 +0

152 +0

19 -1

GitHub
LiME by 504ensicsLabs

LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

created at Sept. 23, 2014, 4:23 p.m.

C

81 +0

1,654 +2

334 +2

GitHub
plaso by log2timeline

Super timeline all the things

created at Sept. 8, 2014, 11:29 p.m.

Python

92 +0

1,650 +3

325 +1

GitHub
scot by sandialabs

Sandia Cyber Omni Tracker (SCOT)

created at Aug. 27, 2014, 8:24 p.m.

JavaScript

38 +0

242 +0

48 +0

GitHub
osxcollector by Yelp

A forensic evidence collection & analysis toolkit for OS X

created at Aug. 4, 2014, 6:25 p.m.

Python

125 +0

1,862 +1

241 +1

GitHub
mastiff by KoreLogicSecurity

Malware static analysis framework

created at July 15, 2014, 8:23 p.m.

Python

18 +0

173 +0

39 +0

GitHub
timesketch by google

Collaborative forensic timeline analysis

created at June 19, 2014, 5:49 p.m.

Python

137 +0

2,517 +3

577 +1

GitHub