DFIR_Resources_REvil_Kaseya

Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack Yesterday Sophos and Huntress Labs identified that Kaseya, a remote management provider popular with MSPs, was compromised to deploy a supply chain ransomware attack. A large number of organisations wer...

bytesrevealer

https://bytesrevealer.online/ VULNEX https://www.vulnex.com/ Bytes Revealer Version: 0.4 Bytes Revealer is a powerful reverse engineering and binary analysis tool designed for security researchers, forensic analysts, and developers. With features like hex view, visual representation, string...

RdpCacheStitcher

RdpCacheStitcher RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps. Using raw RDP cache tile bitmaps extracted by tools like e.g. ANSSI's BMC-Tools https://github.com/ANSSI-FR/bmc-tools as input, it provides a graphical user...

awesome-android-security

Awesome-Android-Security Table of Contents Blog How To's Papers Books Trainings Tools Static Analysis Tools Dynamic Analysis Tools Online APK Analyzers Online APK Decompiler Forensic Analysis Tools Labs Talks Misc Bug Bounty & Writeups Cheat Sheet Checklist Bug Bounty Report Blogs 1-click Exploit...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

DFIR-O365RC

Table of contents: 1. Module description 2. Installation and prerequisites 1. Using Docker 2. Manual Installation 3. Managing the DFIR-O365RC application 1. Creating the application 2. Updating the application 3. Removing the application 4. Permissions and license requirements 5. Functions includ...

Remote-Desktop-Caching-

Remote-Desktop-Caching- This tool allows one to recover old RDP mstsc session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG...

columbo

Columbo Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromise...

MozCache

MozCache Bash script Simple shell script to perform forensic analysis of the Mozilla-Browsers cache Firefox, Iceweasel and Seamonkey. The script orders by date the files cached from a browser of the Mozilla family using the cache version 2. Together with the name of each file the script generates...

physical-analyzer-scripts

physical-analyzer-scripts Cellebrite Physical Analyzer 파이썬 스크립트로 분석가에게 확장된 기능을 제공합니다...

forensic-msvpn

Microsoft Remote Access VPN 포렌식 분석 이 저장소는 Microsoft Remote Access VPN에 대해 수행된 포렌식 분석과 관련된 리소스를 포함하며, 다음 블로그 게시물에서 확인할 수 있습니다: https://www.synacktiv.com/publications/forensic-aspects-of-microsoft-remote-access-vpn.html. Velociraptor 클라이언트 아티팩트 Windows.EventLogs.RemoteAccessVPN.yaml...

lmg

Linux Memory Grabber Linux 메모리 덤프 및 VolatilityTM 프로필을 생성하는 스크립트. Hal Pomeranz [email protected], 2020-02-01 감사의 말 "만약 내가 더 멀리 보았다면, 그것은 거인의 어깨 위에 서 있었기 때문이다." 아이작 뉴턴 이 간단한 도구를 가능하게 만든 많은 분들께 감사드립니다: -- AVML을 제공해 주신 Microsoft의 좋은 분들 -- LiME 작업을 해 주신 Joe Sylve -- 지속적으로 작업을 이어오고 있는...

interrogate

Interrogate Interrogate는 바이너리 자료에서 암호화 키를 식별하기 위한 개념 증명 도구입니다 대상 운영 체제에 관계없이, 주로 메모리 덤프 분석 및 포렌식 용도로 사용됩니다. 버전 0.0.4 기준으로 AES, Serpent, Twofish 및 DER 인코딩된 RSA 키를 식별할 수 있습니다. 이 도구는 NTNU에서의 석사 학위 논문의 일부로 작성되었습니다. 핵심 데이터 버전: 0.0.4 라이선스: GPL 저자: Carsten Maartmann-Moe [email protected] 트위터:...

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis...

FAMA

DEPRECATED: LabCIF - Forensic Analysis for Mobile Apps Getting Started Android extraction and analysis framework with an integrated Autopsy Module. Dump easily user data from a device and generate powerful reports for Autopsy or external applications. Functionalities Extract user application data...

PacketStreamer

PacketStreamer Deepfence PacketStreamer is a high-performance remote packet capture and collection tool. It is used by Deepfence's ThreatStryker security observability platform to gather network traffic on demand from cloud workloads for forensic analysis. Primary design goals: Stay light, captur...

iOSForensic

iOSForensic iosForensic는 iOS 포렌식 분석을 돕는 파이썬 도구입니다. 파일과 로그를 가져오고, sqlite3 데이터베이스를 추출하며, .plist 파일을 XML로 압축 해제합니다. 설치 이 git 저장소를 복제하고 의존성을 설치하기만 하면 됩니다. 의존성 Linux OpenSSH sshpass sqlite3 python = 2.6 Python-magic plistutil 기기 탈옥된 기기 OpenSSH syslogd를 /var/log/syslog로 이것은 애플리케이션 이름입니다. 설치 후 휴대폰을 재시작하...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...