307 Open source projects that are alternatives of or similar to DFIR-O365RC

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices

Python 3 Script to parse out iTunes backups

Python script to decode common encoded PowerShell scripts

Event Trace Log file parser in pure Python

Web browser forensics for Google Chrome/Chromium

incident response scripts

#ThreatHunting #DFIR #Malware #Detection Mind Maps

Invoke-LiveResponse

Truehunter

Automation and Scaling of Digital Forensics Tools

CDIR (Cyber Defense Institute Incident Response) Collector - live collection tool based on oss tool/library

Query and report user logons relations from MS Windows Security Events

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

Automagically extract forensic timeline from volatile memory dump

An Incident Response tool to extract console command history and screen output buffer

Trace ScriptBlock execution for powershell v2

Minimalistic DNS logging tool

Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

Carve file metadata from NTFS index ($I30) attributes

Dumps all of the Key/Value pairs from a LevelDB database

swap_digger is a tool used to automate Linux swap analysis during post-exploitation or forensics. It automates swap extraction and searches for Linux user credentials, web forms credentials, web forms emails, http basic authentication, Wifi SSID and keys, etc.

A tool for forensic file system reconstruction.

Collaborative forensic timeline analysis

Everything related to Linux Forensics

macOS Artifact Parsing Tool

The CyberCX Digger project is designed to help Australian organisations determine if they have been impacted by certain high profile cyber security incidents. Digger provides threat hunting functionality packaged in a simple-to-use tool, allowing users to detect certain attacker activities; all for free.

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

System Management RAM analysis tool

Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)

Provides various Windows Server Active Directory (AD) security-focused reports.

PowerShell Module Handling Authentication to Cloud Services

Educational, CTF-styled labs for individuals interested in Memory Forensics

Timeline of Active Directory changes with replication metadata

Live system forensic collector

You didn't think I'd go and leave the blue team out, right?

An open source toolkit empowering partners understand their customer’s security posture.

My solutions to the 2020 NSA Codebreaker Challenge

ASP.NET Core 2.0 Azure AD authentication example

Examine, create and interact with remote objects in other .NET processes.

node.js based authentication library for Azure with type definitions

Analyst Unknown Cyber Range - a micro web service framework

Tool to sort large collections of files according to common typologies

thunderbird addons provide exchange support: mail, calendar, global address list (contacts)

PowerShell scripts related to SharePoint Online in Microsoft 365

Whitelist entries for cloud identity services

A Splunk Technology Add-on to forward filtered ETW events.

Forensics triage tool relying on Volatility and Foremost

📝 urlRecon - Info Gathering or Recon tool for Urls -> Retrieves * Whois information of the domain * DNS Details of the domain * Server Fingerprint * IP geolocation of the server

An android app that uses Azure AD and the ADAL library for authenticating the user and calling a web API using OAuth 2.0 access tokens.

Unofficial Self-Service Web Portal for Veeam Backup for Microsoft Office 365

U-Net for fingerprint denoising

Paragon APFS SDK Free

Tools for inspecting disk images

A single page app, implemented with an ASP.NET Web API backend, that signs up & signs in users using Azure AD B2C and calls the web API using OAuth 2.0 access tokens.

Recover files using lists of blocks hashes, bypassing the File System entirely

No description or website provided.

Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.