flightsim by alphasoc

A utility to safely generate malicious network traffic patterns and evaluate controls.

created at Jan. 10, 2018, 12:31 p.m.

Go

35 +0

1,188 +2

128 +0

GitHub
Fastir_Collector by SekoiaLab

None

created at Oct. 23, 2015, 9:18 a.m.

Python

63 +0

502 +0

128 +0

GitHub
stringsifter by mandiant

A machine learning tool that ranks strings based on their relevance for malware analysis.

created at Sept. 5, 2019, 1:02 p.m.

Python

30 +0

648 +2

123 +0

GitHub
Raccine by Neo23x0

A Simple Ransomware Vaccine

created at Oct. 3, 2020, 11:30 a.m.

C++

43 +0

938 +1

123 +0

GitHub
RegRipper3.0 by keydet89

RegRipper3.0

created at May 27, 2020, 3:24 p.m.

Perl

27 +0

488 +5

120 +1

GitHub
Kuiper by DFIRKuiper

Digital Forensics Investigation Platform

created at Nov. 1, 2019, 4:45 a.m.

JavaScript

34 +1

721 +1

110 +1

GitHub
bitscout by vitaly-kamluk

Remote forensics meta tool

created at June 30, 2017, 10:20 a.m.

Shell

49 +0

437 +0

105 +0

GitHub
Fenrir by Neo23x0

Simple Bash IOC Scanner

created at Oct. 8, 2015, 3:55 a.m.

Shell

39 +0

662 +2

103 +0

GitHub
uac by tclahr

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

created at Jan. 8, 2020, 5:19 p.m.

Shell

27 +0

638 +9

103 +0

GitHub
mac_apt by ydkhatri

macOS (& ios) Artifact Parsing Tool

created at Aug. 24, 2017, 3:37 p.m.

Python

44 +0

719 +1

99 +0

GitHub
threat_note by DefensePointSecurity

DPS' Lightweight Investigation Notebook

created at Aug. 24, 2015, 2:53 p.m.

HTML

57 +0

420 +0

97 +0

GitHub
doorman by mwielgoszewski

an osquery fleet manager

created at April 22, 2016, 7:31 p.m.

Python

33 +0

616 +0

95 +0

GitHub
ir-rescue by diogo-fernan

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

created at Aug. 2, 2016, 9:01 p.m.

Batchfile

45 +0

447 +0

93 +0

GitHub
matano by matanolabs

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

created at July 3, 2022, 1:41 p.m.

Rust

20 +0

1,359 +2

89 +2

GitHub
CyLR by orlikoski

CyLR - Live Response Collection Tool

created at Sept. 6, 2016, 10:14 p.m.

C#

32 +0

600 +0

88 +0

GitHub
Meerkat by TonyPhipps

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

created at Feb. 8, 2018, 11:30 a.m.

PowerShell

31 +0

423 +0

84 +0

GitHub
Zircolite by wagga40

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

created at March 2, 2021, 11:17 p.m.

Python

24 +0

601 +3

84 +0

GitHub
awesome-event-ids by stuhli

Collection of Event ID ressources useful for Digital Forensics and Incident Response

created at Sept. 22, 2021, 3:36 p.m.

Unknown languages

24 +0

540 +1

83 +0

GitHub
zentral by zentralopensource

Zentral is a high-visibility platform for controlling Apple endpoints in enterprises. It brings great observability to IT and makes tracking & reporting compliance much less manual.

created at Oct. 20, 2015, 2:03 p.m.

Python

31 +0

721 +1

82 +0

GitHub
Aurora-Incident-Response by cyb3rfox

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders

created at June 9, 2020, 12:12 p.m.

JavaScript

40 +0

727 +1

78 +0

GitHub