Douglas-042

Douglas-042 - Threat Hunting Incident Response - PowerShell Hunting DOUGLAS-042 stands as an ingenious embodiment of a PowerShell script meticulously designed to expedite the triage process and facilitate the meticulous collection of crucial evidence derived from both forensic artifacts and the...

MrHandler

MR.HANDLER MR.Handler is a specialized tool designed for responding to security incidents on Linux systems. It connects to target systems via SSH to execute a range of diagnostic commands, gathering crucial information such as network configurations, system logs, user accounts, and running...

ir-rescue

ir-rescue ir-rescue is composed of two sister scripts that collect a myriad of forensic data from 32-bit and 64-bit Windows systems ir-rescue-win and from Unix systems ir-rescue-nix. The scripts respect the order of volatility and artifacts that are changed with the execution e.g. , prefetch file...

Threat-Remediation-Scripts

Introduction Since 2021, I have developed a number of scripts to assist me with my investigations and remediation efforts. I figured, why not share them to the public, in hopes it helps you. How do these scripts work? The scripts I developed are intended to work with Crowdstrike Endpoint Detectio...

sift

Sift Secrets Credential and sensitive-data exposure triage for file shares. When an open share turns up, the question is never "does this repo have a leaked key". It is "what just got exposed, and what do I have to roll before close of business." sift is built for that question: high recall, a fa...

dfirtrack

DFIRTrack Digital Forensics and Incident Response Tracking application is an open source web application mainly based on Django using a PostgreSQL database back end. In contrast to other great incident response tools, which are mainly case-based and support the work of CERTs, SOCs etc. in their...

Cyber-Defence

Introduction This repository holds information released publicly by NCC Group's Cyber Incident Response Team. Contact To request further information about anything in this repository please contact the team at [email protected]. To engage with our CIRT team due to a breach please contact...

TuxResponse

TuxResponse v1.1 Linux Incident Response TuxResponse is incident response script for linux systems written in bash. It can automate incident response activities on Linux systems and enable you to triage systems quickly, while not compromising with the results. Usually corporate systems would have...

cybersecurity-interview-questions

Cybersecurity Interview Questions A Free, Open‑Source Collection for Red Team, Blue Team, Web Security, Incident Response & More Overview This repository is a curated collection of 200+ cybersecurity interview questions and answers – designed for anyone preparing for roles in: Red Teaming /...

IRTriage

Incident Response Triage: Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael'...

MalConfScan

Concept MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a...

dfirtriage

dfirtriage Digital forensic acquisition tool for Windows-based incident response. How to Use To run, drop dfirtriage.exe on the target or connected USB drive and execute with admin rights, -h for help. DFIRTriage v6.0 User's Manual Description This document outlines the functionality and proper u...

attack-stix-data

ATT&CK® STIX Data MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and ...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

VolWeb

Introduction VolWeb is a digital forensic memory analysis platform that leverages the power of the Volatility 3 framework. It is dedicated to aiding in investigations and incident responses. 🧬 Objectives The goal of VolWeb is to enhance the efficiency of memory collection and forensic analysis by...

Trawler

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

serverless-prey

Puma Security Serverless Prey Serverless Prey is a collection of serverless functions FaaS, that, once launched to a cloud environment and invoked, establish a TCP reverse shell, enabling the user to introspect the underlying container: Panther: AWS Lambda written in Node.js Cougar: Azure Functio...

LinuxCatScale

Linux-CatScale IR Collection Script Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the...

Aurora-Incident-Response

Aurora Incident Response Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders. Aurora brings "Spreadsheet of Doom" used in the SANS FOR508 class to the next level. Having led many cases and taught so many students how to do IR right, I realized, that...