DFIR_Resources_REvil_Kaseya

Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack Yesterday Sophos and Huntress Labs identified that Kaseya, a remote management provider popular with MSPs, was compromised to deploy a supply chain ransomware attack. A large number of organisations wer...

DFIR-O365RC

Table of contents: 1. Module description 2. Installation and prerequisites 1. Using Docker 2. Manual Installation 3. Managing the DFIR-O365RC application 1. Creating the application 2. Updating the application 3. Removing the application 4. Permissions and license requirements 5. Functions includ...

ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

FAMA

DEPRECATED: LabCIF - Forensic Analysis for Mobile Apps Getting Started Android extraction and analysis framework with an integrated Autopsy Module. Dump easily user data from a device and generate powerful reports for Autopsy or external applications. Functionalities Extract user application data...

awesome-android-security

Awesome-Android-Security Table of Contents Blog How To's Papers Books Trainings Tools Static Analysis Tools Dynamic Analysis Tools Online APK Analyzers Online APK Decompiler Forensic Analysis Tools Labs Talks Misc Bug Bounty & Writeups Cheat Sheet Checklist Bug Bounty Report Blogs 1-click Exploit...

interrogate

Interrogate Interrogate is a proof-of-concept tool for identification of cryptographic keys in binary material regardless of target operating system, first and foremost for memory dump analysis and forensic usage. Able to identify AES, Serpent, Twofish and DER-encoded RSA keys as of version 0.0.4...

columbo

Columbo Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromise...

Remote-Desktop-Caching-

Remote-Desktop-Caching- This tool allows one to recover old RDP mstsc session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

RdpCacheStitcher

RdpCacheStitcher RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps. Using raw RDP cache tile bitmaps extracted by tools like e.g. ANSSI's BMC-Tools https://github.com/ANSSI-FR/bmc-tools as input, it provides a graphical user...

physical-analyzer-scripts

physical-analyzer-scripts Cellebrite Physical Analyzer python scripts to aid analysts with extended functionality...

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis...

PacketStreamer

PacketStreamer Deepfence PacketStreamer is a high-performance remote packet capture and collection tool. It is used by Deepfence's ThreatStryker security observability platform to gather network traffic on demand from cloud workloads for forensic analysis. Primary design goals: Stay light, captur...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

CitrixNetscalerAnalysis

Citrix Analysis Notebook A jupyter notebook to aid in automating some of the forensic analysis related to Citrix Netscaler hosts compromised via CVE-2019-19781. For help retrieving artifacts to examine see this Citrix triage script. All notes/suggestions are welcome. Feel free to submit pull...

iOSForensic

iOSForensic iosForensic is a python tool to help in forensics analysis on iOS. It get files, logs, extract sqlite3 databases and uncompress .plist files in xml. Installation Simply clone this git repository and install dependencies. Dependencies Linux OpenSSH sshpass sqlite3 python = 2.6...

forensic-msvpn

Microsoft Remote Access VPN Forensic analysis This repository contains resources related to the forensic analysis made on Microsoft Remote Access VPN and available on this blog post: https://www.synacktiv.com/publications/forensic-aspects-of-microsoft-remote-access-vpn.html. a Velociraptor client...

MozCache

MozCache Bash script Simple shell script to perform forensic analysis of the Mozilla-Browsers cache Firefox, Iceweasel and Seamonkey. The script orders by date the files cached from a browser of the Mozilla family using the cache version 2. Together with the name of each file the script generates...

bytesrevealer

https://bytesrevealer.online/ VULNEX https://www.vulnex.com/ Bytes Revealer Version: 0.4 Bytes Revealer is a powerful reverse engineering and binary analysis tool designed for security researchers, forensic analysts, and developers. With features like hex view, visual representation, string...