Top 127 dfir open source projects

swap_digger is a tool used to automate Linux swap analysis during post-exploitation or forensics. It automates swap extraction and searches for Linux user credentials, web forms credentials, web forms emails, http basic authentication, Wifi SSID and keys, etc.

✭ 354

shell security hacking dfir forensics post-exploitation

Thehivedocs

Documentation of TheHive

✭ 353

python api open-source documentation rest free platform analyzer dfir incident-response free-software digital-forensics

Mac apt

macOS Artifact Parsing Tool

✭ 329

python macos dfir forensics

Ir Rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

✭ 311

bash windows malware unix cybersecurity dfir forensics incident-response batch

Python Iocextract

Defanged Indicator of Compromise (IOC) Extractor.

✭ 300

python library osint ioc dfir threat-intelligence malware-research yara decoding base64 threatintel

Recuperabit

A tool for forensic file system reconstruction.

✭ 280

python dfir forensics disk

Security Onion

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management

✭ 2,956

dfir intrusion-detection ids network-security-monitoring log-management nsm hunting

Detectionlabelk

DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.

✭ 273

powershell vagrant dfir packer threat-hunting elk osquery

Lolbas

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

✭ 3,810

XSLT redteam dfir blueteam purpleteam lolbins lolscripts living-off-the-land

Attackdatamap

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

✭ 264

powershell dfir threat-hunting mitre-attack siem

Kuiper

Digital Forensics Investigation Platform

✭ 257

javascript security parser dfir incident-response digital-forensics

Threatpinchlookup

Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension

✭ 257

html security chrome-extension osint dfir incident-response threat-hunting cve shodan threatintel whois virustotal

Yobi

Yara Based Detection Engine for web browsers

✭ 39

javascript HTML CSS firefox scanner malware dfir antivirus yara add-on

VanillaWindowsReference

A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update.

✭ 24

windows research dfir hashes incidentresponse

yara-rules

Yara rules written by me, for free use.

✭ 13

YARA dfir malware-analysis yara yara-rules threat-intelligence

rhq

Recon Hunt Queries

✭ 66

incident-response dfir threat-hunting osquery mitre-attack

Opensource-Endpoint-Monitoring

This repository contains all the config files and scripts used for our Open Source Endpoint monitoring project.

✭ 30

python powershell XSLT Batchfile dfir sigma blueteam defcon26 sysmon-config endpoint-monitoring

minerchk

Bash script to Check for malicious Cryptomining

✭ 36

shell dfir mining cryptocurrency malware-detection

hashlookup-forensic-analyser

Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - https://circl.lu/services/hashlookup/

✭ 43

python bloom-filter dfir nsrl forensic-analysis forensics-investigations dfir-automation nsrllookup hashlookup

factual-rules-generator

Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a machine.

✭ 62

python dfir yara computer-forensics yara-rules

WindowsDFIR

Repository for different Windows DFIR related CMDs, PowerShell CMDlets, etc, plus workshops that I did for different conferences or events.

✭ 51

powershell windows scripts dfir cmd investigations cmdlets

decwindbx

A sort of a toolkit to decrypt Dropbox Windows DBX files

✭ 22

c dropbox dfir decryption odi dbx dpapi

truehunter

Truehunter

✭ 30

python entropy forensics dfir truecrypt veracrypt

fastfinder

Incident Response - Fast suspicious file finder

✭ 116

go YARA incident-response dfir threat-hunting investigation

IRScripts

Incident Response Scripts

✭ 29

python powershell dfir

ir scripts

incident response scripts

✭ 17

powershell windows incident-response forensics dfir sysmon threat-hunting

artifactcollector

🚨 The artifactcollector is a customizable agent to collect forensic artifacts on any Windows, macOS or Linux system

✭ 140

go shell Dockerfile dfir digital-forensics forensicartifacts

DFIRRegex

A repo to centralize some of the regular expressions I've found useful over the course of my DFIR career.

✭ 33

regex dfir grep kape digitalforensics eztools

calamity

A script to assist in processing forensic RAM captures for malware triage

✭ 24

shell Dockerfile dfir malware-analysis volatility memory-forensics

catalyst

Catalyst is an open source SOAR system that helps to automate alert handling and incident response processes

✭ 91

go typescript javascript Vue ANTLR shell incident-response dfir digital-forensics soar

LevelDBDumper

Dumps all of the Key/Value pairs from a LevelDB database

✭ 23

go shell Batchfile cli cross-platform leveldb forensics dfir whatsapp discord-forensics leveldb-database leveldb-dumper leveldb-dump

Get-NetworkConnection

Edited version of Lee Christensen's Get-NetworkConnection which includes timestamp for each network connection

✭ 34

powershell timeline netstat dfir timestamp

yara-validator

Validates yara rules and tries to repair the broken ones.

✭ 37

python dfir yara yara-rules

smram parse

System Management RAM analysis tool

✭ 50

python security analysis firmware forensics dfir uefi smm reversing investigation

pftriage

Python tool and library to help analyze files during malware triage and analysis.

✭ 77

python dfir malware-analysis malware-triage

WELA

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

✭ 442

powershell windows log analysis timeline logs event threat forensics dfir response hunting sigma incident

DDTTX

DDTTX Tabletop Trainings

✭ 22

training dfir infosec tabletop ddttx

EventTranscriptParser

Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)

✭ 22

python windows forensics dfir cybersecurity eventtranscript diagnostic-data

MemProcFS-Analyzer

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

✭ 89

incident-response dfir digital-forensics memory-forensics live-response memprocfs

osint to timesketch

Virustotal Data to Timesketch

✭ 15

python dfir threatintel virustotal timesketch

Evilize

Parses Windows event logs files based on SANS Poster

✭ 24

powershell events incident-response dfir sans evt evtx eventlogs

PSTrace

Trace ScriptBlock execution for powershell v2

✭ 38

c C#CMake incident-response forensics dfir etw

DFIR-O365RC

PowerShell module for Office 365 and Azure log collection

✭ 158

powershell Dockerfile devops azure forensics dfir azure-active-directory office365 exchangeonline

Docker-Templates

Docker configurations for TheHive, Cortex and 3rd party tools

✭ 71

shell docker devops deployment incident-response dfir thehive cortex

ad-privileged-audit

Provides various Windows Server Active Directory (AD) security-focused reports.

✭ 42

powershell security auditing security-audit active-directory forensics dfir cybersecurity security-hardening account-management risk-assessment information-gathering blueteam security-tools system-hardening purpleteam reporting-tool security-auditing-tool

iTunes Backup Reader

Python 3 Script to parse out iTunes backups

✭ 108

python backups ios mobile itunes forensics dfir kape itunes-backups

uac

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

✭ 260