LogonTracer by JPCERTCC
Investigate malicious Windows logon by visualizing and analyzing Windows event log
created at Nov. 24, 2017, 6:07 a.m.
security-apis by deralexxx
A collective list of public APIs for use in security. Contributions welcome
created at Jan. 9, 2018, 7:58 p.m.
sysmon-modular by olafhartong
A repository of sysmon configuration modules
created at Jan. 13, 2018, 9:20 p.m.
artifacts-kb by ForensicArtifacts
Digital Forensics Artifacts Knowledge Base
created at Jan. 17, 2018, 7:31 p.m.
APTSimulator by NextronSystems
A toolset to make a system look as if it was the victim of an APT attack
created at Feb. 3, 2018, 2:19 p.m.
Meerkat by TonyPhipps
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
created at Feb. 8, 2018, 11:30 a.m.
RedHunt-OS by redhuntlabs
Virtual Machine for Adversary Emulation and Threat Hunting
created at March 14, 2018, 7:31 p.m.
diffy by Netflix-Skunkworks
(DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
created at May 1, 2018, 10:11 p.m.
pyarascanner by nogoodconfig
A simple many-rules to many-files YARA scanner for incident response or malware zoos.
created at May 3, 2018, 11:49 a.m.
SysmonSearch by JPCERTCC
Investigate suspicious activity by visualizing Sysmon's event log
created at July 31, 2018, 11:25 p.m.