Anti-Forensics

Anti-Forensics A Repository to Track Anti-Forensic Techniques This list is built based on the response of the DFIR community and the techniques we currently cover in our Anti-Forensics course. Do you have any cool Anti-Forensic ideas to share? DFIR DigitalForensics...

CVE-2019-19781

CVE-2019-19781 DFIR notes CVE-2019-19781 scanner CVE-2019-19781 Honeypot Reach me on Twitter @x1sec...

macos-collector

macos-collector macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR macos-collector.sh is a Shell script utilized to collect macOS Forensic Artifacts from a compromised macOS endpoint using primarily Aftermath by Jamf Threat Labs. Download Download the latest version of...

EnableWindowsLogSettings

Yamato Security's Windows Event Log Configuration Guide For DFIR And Threat Hunting English | 日本語 This is yet another guide on properly configuring and monitoring Windows event logs with an emphasis on logging for sigma rules. This is a work in progress, so check back please periodically for...

Detection

About This repository contains detection rules and IOCs that we were able to extract and use in the context of our DFIR projects and malware analyses. Contact Follow us on Twitter: https://twitter.com/SIFalconTeam...

CVE-2021-36934-DLL-Hijacking-DFIR-Investigation

" CVE-2021-36934-DLL-Hijacking-DFIR-Investigation"...

dfir-toolkit

!CAUTION DFIR Toolkit is leaving github Why? We believe that all men and women, and all human between and above are created equal. In this mindset, it does not make sense to judge people based on their birthplace, or their language, color, religion, or whatsoever. We believe that who you are is...

htb-writeups

Writeups de Hack The Box - El recurso definitivo de HTB La colección más completa de writeups de Hack The Box , guías paso a paso y hojas de referencia en GitHub. Más de 500 máquinas, más de 400 desafíos, ProLabs, Sherlocks DFIR, eventos CTF, metodología de pruebas de penetración y preparación pa...

yeti

Plataforma Yeti Yeti tiene como objetivo cerrar la brecha entre los profesionales de CTI y DFIR al proporcionar una plataforma de inteligencia forense y un pipeline para equipos de DFIR. Nació de la frustración de tener que responder a la pregunta "¿dónde he visto este artefacto antes?" o "¿cómo...

ma2tl

ma2tl macapt a timeline Esta es una herramienta DFIR para generar una línea de tiempo forense de macOS a partir de las bases de datos de resultados de análisis de macapt. Requisitos Python 3.7.0 o posterior pytz tzlocal xlsxwriter Instalación % git clone https://github.com/mnrkbys/ma2tl.git Uso %...

vestigium

🔎 Vestigium Agente autônomo de análise forense e CTF. Inge...

OmniTriage

OmniTriage ⚡ -brightgreen.svg?style=flat Zero-dependency, sub-second Windows live digital forensics and incident response DFIR triage engine designed for rapid USB responders. 📌 The Problem in Modern Digital Forensics During live incident response, time and stealth are everything. Traditional...

forensic-timeliner

Высокоскоростной движок криминалистической обработки, созданный для специалистов DFIR. Быстрое объединение CSV-вывода от лучших инструментов триажа в единую мини-хронологию со встроенными фильтрацией, обнаружением артефактов, фильтрацией по датам, присвоением ключевых слов и дедупликацией. Релиз...

Forensic-Investigation-of-Web-Attacks-Using-Server-Logs

🛡️ Forensic Investigation of Web Attacks Using Server Logs DF...

macos-collector v1.7.0

macos-collector macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR macos-collector.sh is a Shell script utilized to collect macOS Forensic Artifacts from a compromised macOS endpoint using primarily Aftermath by Jamf Threat Labs. Download Download the latest version of...

Conti-Ransomware-DFIR-Investigation

Conti Ransomware — DFIR Investigation ProxyShell Exploitation...

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

A practitioner’s guide to log visibility, incident readiness, and threat hunting across the major version control services...

yeti v2.7.1

Yeti Platform Yeti aims to bridge the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline for DFIR teams. It was born out of frustration of having to answer the question "where have I seen this artifact before?" or "how do I search for IOCs related t...

iris-web v2.4.29

Incident Response Investigation System Current Version v2.4.20 Online Demonstration IRIS Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Table of contents Getting Started Run IrisWeb Configuration Versioning Showcase...

yeti v2.6.1

Yeti Platform Yeti aims to bridge the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline for DFIR teams. It was born out of frustration of having to answer the question "where have I seen this artifact before?" or "how do I search for IOCs related t...