#1IR playbooks, triage, case management, evidence collection, and incident management tools.
Kitploit recommended
intezer/linux-explorerEasy-to-use live forensics toolbox for Linux endpoints
nbulischeck/tytonKernel-Mode Rootkit Hunter
dfir-dd/dfir-toolkitCLI tools for forensic investigation of Windows artifacts
certcc/cve-2021-44228_scannerScanners for Jar files that may be vulnerable to CVE-2021-44228
opencspm/opencspmOpen Cloud Security Posture Management Engine
captaingeech42/ransomwatchRansomware leak site monitoring
cisagov/esxiargs-recoverA tool to recover from ESXiArgs ransomware
trailofbits/sinterA user-mode application authorization system for MacOS written in Swift
cado-security/varcVolatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use…
504ensicslabs/dammDifferential Analysis of Malware in Memory
target/halogenAutomatically create YARA rules from malicious documents.
megamansec/ldap-monitoring-watchdogLDAP Watchdog: A real-time linux-compatible LDAP monitoring tool for detecting directory changes, providing visibility into additions, modifications,…
nict-csl/existEXIST is a web application for aggregating and analyzing cyber threat intelligence.
cado-security/rip_rawRip Raw is a small tool to analyse the memory of compromised Linux systems.
0x0v1/audixAudix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring
