WELA by Yamato-Security
WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）
created at May 13, 2021, 10:33 p.m.
MalConfScan by JPCERTCC
Volatility plugin for extracts configuration data of known malware
created at April 22, 2019, 12:23 a.m.
dftimewolf by log2timeline
A framework for orchestrating forensic collection, processing and data export
created at July 29, 2016, 1:54 p.m.
diffy by Netflix-Skunkworks
(DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
created at May 1, 2018, 10:11 p.m.
falcon-orchestrator by CrowdStrike
CrowdStrike Falcon Orchestrator provides automated workflow and response capabilities
created at April 22, 2016, 1:25 a.m.
gsvsoc_cirt-playbook-battle-cards by guardsight
Cyber Incident Response Team Playbook Battle Cards
created at Oct. 27, 2019, 4:28 a.m.
VolatilityBot by mkorman90
VolatilityBot – An automated memory analyzer for malware samples and memory dumps
created at Feb. 4, 2015, 3:13 p.m.
SysmonSearch by JPCERTCC
Investigate suspicious activity by visualizing Sysmon's event log
created at July 31, 2018, 11:25 p.m.
inVtero.net by ShaneK2
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
created at April 29, 2011, 4:37 a.m.
hostintel by keithjjones
A modular Python application to collect intelligence for malicious hosts.
created at Aug. 22, 2016, 8:25 p.m.
margaritashotgun by ThreatResponse
Remote Memory Acquisition Tool
created at Aug. 9, 2016, 5:39 p.m.