azurelinux

Azure Linux 4 An open-source Linux distribution built and optimized forAzure, with sources derived from Fedora Linux. Azure Linux provides a secured, reliable operating system for virtual machines, containers, and bare-metal platforms. Azure Linux is built on a robust open-source foundation from...

androidqf

androidqf NOTE: this project is currently not maintained. An independent fork can be found under theMVT Project. androidqf Android Quick Forensics is a portable tool to simplify the acquisition of relevant forensic data from Android devices. Download androidqf Build Executable binaries for Linux,...

hawk

Hawk Documentation and Resources Visit hawkforensics.io for comprehensive documentation including: Detailed installation and permissions guides Step-by-step tutorials and "How to" videos Troubleshooting help Best practices and usage examples What is Hawk? Hawk is a free, open-source PowerShell...

ir-rescue

ir-rescue ir-rescue is composed of two sister scripts that collect a myriad of forensic data from 32-bit and 64-bit Windows systems ir-rescue-win and from Unix systems ir-rescue-nix. The scripts respect the order of volatility and artifacts that are changed with the execution e.g. , prefetch file...

macOSTriageCollectionScript

macOSTriageCollectionScript A triage data collection script for macOS that utilises sysdiagnose with a few additions to gather useful triage data for investigations. What does the script collect? Data collected includes: sysdiagnose , a utility on a vareity of macOS/iOS operating systems that...

pict

PICT - Kit de herramientas de recolección post-infección Este conjunto de scripts está diseñado para recolectar una variedad de datos de un endpoint que se cree infectado, para facilitar el proceso de respuesta a incidentes. Estos datos no deben considerarse como una recolección forense completa,...

SecRespond: Benchmarking AI Agents for Real-World Post-Compromise Incident Response

Large Language Model LLM agents are increasingly adopted in real-world security operations with access to host artifacts and command-line interfaces CLIs, making it critical to thoroughly assess their security capabilities. However, existing cybersecurity benchmarks focus on pre-compromise settin...

FACT - A Tool To Collect, Process And Visualise Forensic Data From Clusters Of Machines Running In The Cloud Or On-Premise

FACT is a tool to collect, process and visualise forensic data from clusters of machines running in the cloud or on-premise. Deployment For a basic single-node deployment, we recommend using Docker and Docker Compose. First, read docker-compose.yaml for configuration and requirements. Then, start...

Court Ruling on Forensic Data Breach Reporting Flying Under the Radar

One thing that may have flown under the radar in recent weeks is that a court has ruled that Capital One must allow plaintiffs to review a cybersecurity firm’s forensic report related to the bank’s 2019 data breach despite the bank’s protests that it is a protected legal document. You can read mo...

IR & Forensics in the Cloud

More and more organisations are moving their business to the cloud. This makes securing data and being able to respond effectively to incidents in cloud environments an important topic. Having the skills on hand to properly collect digital forensics data in response to a legal dispute or during a...

Contain Attacks in Real Time with Live Response in Cb Defense

Endpoint security is broken. Yes, you’ve heard it before - traditional, signature-based antivirus AV can’t keep up with the volume of new malware and advanced attack methods being developed by cyber criminals every day. And that’s absolutely true. But a report published last year highlights an ev...

Cb Defense October 2017 Release Speeds Up Your Response

During a response scenario, every minute counts. The faster you can complete your investigation, the faster you can start taking corrective action. That’s why this week we’re happy to announce the October 2017 update of Cb Defense, which improves search functionality within the Cb Defense console...

Windows Forensic Data Collection: IR-rescue

Windows Forensic Data Collection ir-rescue is a Windows Batch script that collects a myriad of forensic data from 32-bit and 64-bit Windows systems while respecting the order of volatility. It is intended for incident response use at different stages in the analysis and investigation process. It...

PowerShell Incident Response: Psrecon

Psrecon is an open source script that you can use to gather data from a remote Windows host using PowerShell v2 or later, organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushe...

Ditto Forensic FieldStation 2013Oct15a - Multiple Vulnerabilities

Exploit for php platform in category web applications 0 ======== Introduction / Background / Impact ======== In computer forensics http://en.wikipedia.org/wiki/Computerforensics one essential requirement is that evidence data does not get modified at all or not unnoticed, at least. Therefore IT...

DHS To Critical Infrastructure Owners: Hold On To Data After Cyber Attack

The Department of Homeland Security Is Offering Organizations That Use Industrial Control Systems advice or mitigating the effects of cyber attacks. Among the agency’s recommendations: hold on to data from infected systems and prevent enemies from moving within your organization. DHS’s Industrial...