Aurora-Incident-Response

Aurora Incident Response Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders. Aurora brings "Spreadsheet of Doom" used in the SANS FOR508 class to the next level. Having led many cases and taught so many students how to do IR right, I realized, that...

dfirtrack

DFIRTrack Digital Forensics and Incident Response Tracking application is an open source web application mainly based on Django using a PostgreSQL database back end. In contrast to other great incident response tools, which are mainly case-based and support the work of CERTs, SOCs etc. in their...

TrueTree

TrueTree About Read all about the TrueTree concept here TrueTree is more than just a pstree command for macOS. It is used to display a process tree for current running processes while using a hierarchy built on additoinal pids that can be collected from the operating system. The standard process...

kraken

Kraken is a simple cross-platform Yara scanner that can be built for Windows, Mac, FreeBSD and Linux. It is primarily intended for incident response, research and ad-hoc detections not for endpoint protection. Following are the core features: Scan running executables and memory of running process...

uac

Unix-like Artifacts Collector UAC About • Documentation • Main Features • Supported Operating Systems • Usage • Contributing • Support • License 🔎 About UAC UAC Unix-like Artifacts Collector is a powerful and extensible incident response tool designed for forensic investigators, security analysts...

ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

cybersecurity-interview-questions

Cybersecurity Interview Questions A Free, Open‑Source Collection for Red Team, Blue Team, Web Security, Incident Response & More Overview...

Douglas-042

Douglas-042 - Threat Hunting Incident Response - PowerShell Hunting DOUGLAS-042 stands as an ingenious embodiment of a PowerShell script meticulously designed to expedite the triage process and facilitate the meticulous collection of crucial evidence derived from both forensic artifacts and the...

VolWeb

Introduction VolWeb is a digital forensic memory analysis platform that leverages the power of the Volatility 3 framework. It is dedicated to aiding in investigations and incident responses. 🧬 Objectives The goal of VolWeb is to enhance the efficiency of memory collection and forensic analysis by...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

DataSurgeon

DataSurgeon v1.2.8 DataSurgeon ds is a versatile tool designed for incident response, DLP, penetration testing, and CTF challenges. It allows for the extraction of various types of sensitive information including emails, phone numbers, hashes, credit cards, URLs, IP addresses, MAC addresses, SRV...

cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

TuxResponse

TuxResponse v1.1 Linux Incident Response TuxResponse is incident response script for linux systems written in bash. It can automate incident response activities on Linux systems and enable you to triage systems quickly, while not compromising with the results. Usually corporate systems would have...

dissect

dissect Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT part of NCC Group. This project is a meta package, it will install all other Dissect modules wi...

Microsoft-Extractor-Suite

Getting started with the Microsoft-Extractor-Suite To get started with the Microsoft-Extractor-Suite, check out the Microsoft-Extractor-Suite docs...

iris-web

Incident Response Investigation System Current Version v2.4.20 Online Demonstration IRIS Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Table of contents Getting Started Run IrisWeb Configuration Versioning Showcase...

Live-Forensicator

🛡️ Forensicator 🛡️ Cross-platform Incident Response & Live Forensics Toolkit Windows PowerShell | Linux Bash | macOS Shell Built for fast, structured, and actionable forensic investigations. 🤔 About Forensicator is a cross-platform incident response and live forensics toolkit. It is designed to...

malwarescanner

MalwareScanner 基于哈希比对的非常基础的恶意软件扫描器 有时在应急响应中可能需要这个。 如果你在响应中发现新的或可疑的文件，你想检查这些文件在系统中的位置。那么你可能需要这样的工具。这是一个演示版本，不完整。你需要修改代码，使其成为你自己的。 如果有任何变更需求或需要额外功能，请告知。 如果它有帮助，请点"星标"。这样它会继续改进。 功能特性 基于哈希的文件检查（免费恶意软件哈希） 扫描包括子目录 多线程任务 定义要扫描的文件扩展名 定义不扫描的目录 易于将扫描日志附加到 SIEM（例如 Splunk） 易于处理和可修改的代码/函数结构（如果你感兴趣） v1.0.5...

malwarescanner

MalwareScanner Very basic malware Scanner by hash comparison Sometimes this can be needed when an incident response. If you found new or suspicious files when you do response, you want to check out where these files exist in systems. so then you may need like this tool. this is a demo version. no...

Threat-Remediation-Scripts

Introducción Desde 2021, he desarrollado varios scripts para ayudarme en mis investigaciones y esfuerzos de remediación. Pensé: ¿por qué no compartirlos con el público, con la esperanza de que te ayuden? ¿Cómo funcionan estos scripts? Los scripts que desarrollé están diseñados para funcionar con...