232 Open source projects that are alternatives of or similar to Atc React

Recon Hunt Queries

Trace ScriptBlock execution for powershell v2

Invoke-LiveResponse

Python script to decode common encoded PowerShell scripts

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Cortex Analyzers Repository

A portable OSINT Swiss Army Knife for DFIR/OSINT professionals 🕵️ 🕵️ 🕵️

#ThreatHunting #DFIR #Malware #Detection Mind Maps

Documentation of TheHive

Detecting ATT&CK techniques & tactics for Linux

A repository of sysmon configuration modules

Catalyst is an open source SOAR system that helps to automate alert handling and incident response processes

A Splunk app mapped to MITRE ATT&CK to guide your threat hunts

DFIRTrack - The Incident Response Tracking Application

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

Imago is a python tool that extract digital evidences from images.

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices

Docker configurations for TheHive, Cortex and 3rd party tools

The CyberCX Digger project is designed to help Australian organisations determine if they have been impacted by certain high profile cyber security incidents. Digger provides threat hunting functionality packaged in a simple-to-use tool, allowing users to detect certain attacker activities; all for free.

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension

Windows Events Attack Samples

Digital Forensics Investigation Platform

Python API Client for Cortex

Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.

An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view.

A curated list of tools for incident response

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

All-in-one bundle of MISP, TheHive and Cortex

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

🔮 Visibility Across Space and Time

Cortex: a Powerful Observable Analysis and Active Response Engine

Forensics artefact collection tool for systems running Microsoft Windows

Test Blue Team detections without running any attack.

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

Carve file metadata from NTFS index ($I30) attributes

Live system forensic collector

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

CDIR (Cyber Defense Institute Incident Response) Collector - live collection tool based on oss tool/library

Parses Windows event logs files based on SANS Poster

incident response scripts

ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.

Incident Response - Fast suspicious file finder

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

A list of cyber-chef recipes and curated links

PS / Bash / Python / Other scripts For FUN!

Python API Client for TheHive

Investigate malicious Windows logon by visualizing and analyzing Windows event log

Warning lists to inform users of MISP about potential false-positives or other information in indicators

Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads

Misc Threat Hunting Resources

Fast and efficient osquery management

Collaborative forensic timeline analysis

Tools for the Computer Incident Response Team 💻

Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI

Indicator Extractor

Wazuh - Kibana plugin

PCAP Samples for Different Post Exploitation Techniques

JSON DataSet for macOS mapped to MITRE ATT&CK Tactics.