251 Open source projects that are alternatives of or similar to truehunter

incident response scripts

macOS Artifact Parsing Tool

A tool for forensic file system reconstruction.

PowerShell module for Office 365 and Azure log collection

Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)

Web browser forensics for Google Chrome/Chromium

Automation and Scaling of Digital Forensics Tools

#ThreatHunting #DFIR #Malware #Detection Mind Maps

Event Trace Log file parser in pure Python

Python script to decode common encoded PowerShell scripts

Everything related to Linux Forensics

Dumps all of the Key/Value pairs from a LevelDB database

Carve file metadata from NTFS index ($I30) attributes

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

Automagically extract forensic timeline from volatile memory dump

Provides various Windows Server Active Directory (AD) security-focused reports.

Query and report user logons relations from MS Windows Security Events

The CyberCX Digger project is designed to help Australian organisations determine if they have been impacted by certain high profile cyber security incidents. Digger provides threat hunting functionality packaged in a simple-to-use tool, allowing users to detect certain attacker activities; all for free.

Live system forensic collector

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

Educational, CTF-styled labs for individuals interested in Memory Forensics

CDIR (Cyber Defense Institute Incident Response) Collector - live collection tool based on oss tool/library

Invoke-LiveResponse

Minimalistic DNS logging tool

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

Python 3 Script to parse out iTunes backups

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices

Collaborative forensic timeline analysis

Trace ScriptBlock execution for powershell v2

System Management RAM analysis tool

Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

swap_digger is a tool used to automate Linux swap analysis during post-exploitation or forensics. It automates swap extraction and searches for Linux user credentials, web forms credentials, web forms emails, http basic authentication, Wifi SSID and keys, etc.

Timeline of Active Directory changes with replication metadata

An Incident Response tool to extract console command history and screen output buffer

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Virustotal Data to Timesketch

Scripts to process macOS forensic artifacts

Parses Windows event logs files based on SANS Poster

A random generator (string and number)

Edited version of Lee Christensen's Get-NetworkConnection which includes timestamp for each network connection

Code for the DIMVA 2018 paper: "MemScrimper: Time- and Space-Efficient Storage of Malware Sandbox Memory Dumps"

Validates yara rules and tries to repair the broken ones.

U-Net for fingerprint denoising

Algorithms for causal inference and the detection of dynamical coupling from time series, and for approximation of the transfer operator and invariant measures.

A script to assist in processing forensic RAM captures for malware triage

AntroPy: entropy and complexity of (EEG) time-series in Python

Docker configurations for TheHive, Cortex and 3rd party tools

CorBinian: A toolbox for modelling and simulating high-dimensional binary and count-data with correlations

Catalyst is an open source SOAR system that helps to automate alert handling and incident response processes

Useful tools for CTF competitions

This is a GUI (for Windows 64 bit) for a procedure to virtualize your EWF(E01), DD (raw), AFF disk image file without converting it, directly with VirtualBox, forensically proof.

Ingestors extract the contents of mixed unstructured documents into structured (followthemoney) data.

Python tool and library to help analyze files during malware triage and analysis.

My solutions to the 2020 NSA Codebreaker Challenge

Simple web-based password generator

Incident Response Scripts

🚨 The artifactcollector is a customizable agent to collect forensic artifacts on any Windows, macOS or Linux system

The Python implementation of the AFF4 standard.

Boltzmann entropy of a landscape gradient