caldera

Caldera™ Caldera™ is a cyber security platform designed to easily automate adversary emulation, assist manual red-teams, and automate incident response. It is built on the MITRE ATT&CK™ framework and is an active research project at MITRE. The framework consists of two components: 1. The core...

MemProcFS

MemProcFS: MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system. Easy trivial point and click memory analysis without the need for complicated commandline arguments! Access memory content and artifacts via files in a mounted virtual file system or v...

awesome-dfir-skills

🔥 awesome-dfir-skills A community-driven collection of DFIR / incident response skills : reusable prompts, workflows, and helper files that help practitioners move faster, stay consistent, and maybe—just maybe—get some sleep. 🚀 Quick Start 1. Pick a skill from skills/README.md 2. Copy/paste it in...

cloud-sniper

Cloud Sniper has a new home!! Click here to visit!! Cloud Security Operations What is Cloud Sniper? Cloud Sniper is a platform designed to manage Security Operations in cloud environments. It is an open platform which allows responding to security incidents by accurately analyzing and correlating...

autoresponder

AutoResponder Carbon Black Response IR tool for hunting threats in an environment What is it? AutoResponder is a tool aimed to help people to carry out their Incident Response tasks WITH the help of Carbon Black Response's awesome capabilities and WITHOUT much bothering IT/System/Network Teams Wh...

Microsoft-Extractor-Suite

Getting started with the Microsoft-Extractor-Suite To get started with the Microsoft-Extractor-Suite, check out the Microsoft-Extractor-Suite docs. About Microsoft-Extractor-Suite Microsoft-Extractor-Suite is a fully-featured, actively-maintained, Powershell tool designed to streamline the proces...

dissect

dissect Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT part of NCC Group. This project is a meta package, it will install all other Dissect modules wi...

attackgen

AttackGen AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK and ATLAS frameworks. The tool generates tailored incident response scenarios based on user-selected threat actor groups, AI attack case...

iris-web

Incident Response Investigation System Current Version v2.4.20 Online Demonstration IRIS Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Table of contents Getting Started Run IrisWeb Configuration Versioning Showcase...

nextjs-rce-incident-response

Next.js RCE Incident Response — CVE-2025-55182 Type: Live Production Incident Response Vulnerability: CVE-2025-55182 — React Server Components Insecure Deserialization RCE Affected System: Next.js frontend + remote production server Role: Cyber Security Intern — SenseLive Technologies Date:...

Threat-Remediation-Scripts

Introduction Since 2021, I have developed a number of scripts to assist me with my investigations and remediation efforts. I figured, why not share them to the public, in hopes it helps you. How do these scripts work? The scripts I developed are intended to work with Crowdstrike Endpoint Detectio...

MalConfScan

Concept MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a...

ir-rescue

ir-rescue ir-rescue is composed of two sister scripts that collect a myriad of forensic data from 32-bit and 64-bit Windows systems ir-rescue-win and from Unix systems ir-rescue-nix. The scripts respect the order of volatility and artifacts that are changed with the execution e.g. , prefetch file...

ics-forensics-tools

ICSpector: Microsoft ICS Forensics Framework Microsoft ICS Forensics Tools framework is an open-source forensics framework that enables the analysis of Industrial PLC metadata and project files. The framework provides investigators with a convenient way to scan for PLCs and identify any suspiciou...

attack-stix-data

ATT&CK® STIX Data MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and ...

malwarescanner

MalwareScanner Very basic malware Scanner by hash comparison Sometimes this can be needed when an incident response. If you found new or suspicious files when you do response, you want to check out where these files exist in systems. so then you may need like this tool. this is a demo version. no...

Cyber-Defence

Introduction This repository holds information released publicly by NCC Group's Cyber Incident Response Team. Contact To request further information about anything in this repository please contact the team at [email protected]. To engage with our CIRT team due to a breach please contact...

whids

IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases as a lot of changes happened. All this will be updated in time when a stable version will be released see Roadmap until next release. Feel free to run beta releases on your own and as...

dfirtriage

dfirtriage Digital forensic acquisition tool for Windows-based incident response. How to Use To run, drop dfirtriage.exe on the target or connected USB drive and execute with admin rights, -h for help. DFIRTriage v6.0 User's Manual Description This document outlines the functionality and proper u...

serverless-prey

Puma Security Serverless Prey Serverless Prey is a collection of serverless functions FaaS, that, once launched to a cloud environment and invoked, establish a TCP reverse shell, enabling the user to introspect the underlying container: Panther: AWS Lambda written in Node.js Cougar: Azure Functio...