#1IR playbooks, triage, case management, evidence collection, and incident management tools.
Kitploit recommended
deepfence/packetstreamer⭐ ⭐ Distributed tcpdump for cloud native environments ⭐ ⭐
yelparchive/osxcollectorA forensic evidence collection & analysis toolkit for OS X
maliceio/maliceVirusTotal Wanna Be - Now with 100% more Hipster
google/stenographerStenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those…
mozilla/migDistributed & real time digital forensics at the speed of the cloud
snovvcrash/usbripTracking history of USB events on GNU/Linux
dropbox/securitybotDistributed alerting for the masses!
mandiant/silketwC# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…
cloudflare/mitmengineA MITM (monster-in-the-middle) detection tool. Used to build MALCOLM:
grapl-security/graplGraph platform for Detection and Response
t4d/stalkphishStalkPhish - The Phishing kits stalker, harvesting phishing kits for investigations.
mandiant/mandiant-azure-ad-investigatorRead-only PowerShell module for detecting UNC2452 and other threat actor artifacts in Azure AD, auditing federated domains, service principals,…
ebwi11/agentsmith-hidsBy Kprobe technology Open Source Host-based Intrusion Detection System(HIDS), from E_Bwill.
maldev-academy/dumpchromesecretsExtract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsing history, and bookmarks
salesforce/hasshHASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be…
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
