Awesome Incident Response

A curated list of tools and resources for security incident response, aimed to help security analysts and DFIR teams.

Digital Forensics and Incident Response (DFIR) teams are groups of people in an organization responsible for managing the response to a security incident, including gathering evidence of the incident, remediating its effects, and implementing controls to prevent the incident from recurring in the future.

Contents

• Adversary Emulation
• All-In-One Tools
• Books
• Communities
• Disk Image Creation Tools
• Evidence Collection
• Incident Management
• Knowledge Bases
• Linux Distributions
• Linux Evidence Collection
• Log Analysis Tools
• Memory Analysis Tools
• Memory Imaging Tools
• OSX Evidence Collection
• Other Lists
• Other Tools
• Playbooks
• Process Dump Tools
• Sandboxing/Reversing Tools
• Scanner Tools
• Timeline Tools
• Videos
• Windows Evidence Collection

IR Tools Collection

Adversary Emulation

• APTSimulator - Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised.
• Atomic Red Team (ART) - Small and highly portable detection tests mapped to the MITRE ATT&CK Framework.
• AutoTTP - Automated Tactics Techniques & Procedures. Re-running complex sequences manually for regression tests, product evaluations, generate data for researchers.
• Caldera - Automated adversary emulation system that performs post-compromise adversarial behavior within Windows Enterprise networks. It generates plans during operation using a planning system and a pre-configured adversary model based on the Adversarial Tactics, Techniques & Common Knowledge (ATT&CK™) project.
• DumpsterFire - Modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations.
• Metta - Information security preparedness tool to do adversarial simulation.
• Network Flight Simulator - Lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility.
• Red Team Automation (RTA) - RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.
• RedHunt-OS - Virtual machine for adversary emulation and threat hunting.

All-In-One Tools

• Belkasoft Evidence Center - The toolkit will quickly extract digital evidence from multiple sources by analyzing hard drives, drive images, memory dumps, iOS, Blackberry and Android backups, UFED, JTAG and chip-off dumps.
• CimSweep - Suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
• CIRTkit - CIRTKit is not just a collection of tools, but also a framework to aid in the ongoing unification of Incident Response and Forensics investigation processes.
• Cyber Triage - Cyber Triage collects and analyzes host data to determine if it is compromised. It's scoring system and recommendation engine allow you to quickly focus on the important artifacts. It can import data from its collection tool, disk images, and other collectors (such as KAPE). It can run on an examiner's desktop or in a server model. Developed by Sleuth Kit Labs, which also makes Autopsy.
• Cynative - Deep research agent for your infra - sandboxed, read-only, covers AWS, GCP, Azure, K8s, GitHub and GitLab.
• Dissect - Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
• Doorman - osquery fleet manager that allows remote management of osquery configurations retrieved by nodes. It takes advantage of osquery's TLS configuration, logger, and distributed read/write endpoints, to give administrators visibility across a fleet of devices with minimal overhead and intrusiveness.
• Falcon Orchestrator - Extendable Windows-based application that provides workflow automation, case management and security response functionality.
• Flare - A fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing.
• Fleetdm - State of the art host monitoring platform tailored for security experts. Leveraging Facebook's battle-tested osquery project, Fleetdm delivers continuous updates, features and fast answers to big questions.

Books

• Applied Incident Response - Steve Anson's book on Incident Response.
• Art of Memory Forensics - Detecting Malware and Threats in Windows, Linux, and Mac Memory.
• Crafting the InfoSec Playbook: Security Monitoring and Incident Response Master Plan - by Jeff Bollinger, Brandon Enright and Matthew Valites.
• Digital Forensics and Incident Response: Incident response techniques and procedures to respond to modern cyber threats - by Gerard Johansen.
• Introduction to DFIR - By Scott J. Roberts.
• Incident Response & Computer Forensics, Third Edition - The definitive guide to incident response.
• Incident Response Techniques for Ransomware Attacks - A great guide to build an incident response strategy for ransomware attacks. By Oleg Skulkin.
• Incident Response with Threat Intelligence - Great reference to build an incident response plan based also on Threat Intelligence. By Roberto Martinez.
• Intelligence-Driven Incident Response - By Scott J. Roberts, Rebekah Brown.
• Operator Handbook: Red Team + OSINT + Blue Team Reference - Great reference for incident responders.
• Practical Memory Forensics - The definitive guide to practice memory forensics. By Svetlana Ostrovskaya and Oleg Skulkin.
• The Practice of Network Security Monitoring: Understanding Incident Detection and Response - Richard Bejtlich's book on IR.

Communities

• Digital Forensics Discord Server - Community of 8,000+ working professionals from Law Enforcement, Private Sector, and Forensic Vendors. Additionally, plenty of students and hobbyists! Guide here.
• Slack DFIR channel - Slack DFIR Communitiy channel - Signup here.

Disk Image Creation Tools

• AccessData FTK Imager - Forensics tool whose main purpose is to preview recoverable data from a disk of any kind. FTK Imager can also acquire live memory and paging file on 32bit and 64bit systems.
• Bitscout - Bitscout by Vitaly Kamluk helps you build your fully-trusted customizable LiveCD/LiveUSB image to be used for remote digital forensics (or perhaps any other task of your choice). It is meant to be transparent and monitorable by the owner of the system, forensically sound, customizable and compact.
• GetData Forensic Imager - Windows based program that will acquire, convert, or verify a forensic image in one of the following common forensic file formats.
• Guymager - Free forensic imager for media acquisition on Linux.
• Magnet ACQUIRE - ACQUIRE by Magnet Forensics allows various types of disk acquisitions to be performed on Windows, Linux, and OS X as well as mobile operating systems.

Evidence Collection

• Acquire - Acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container. This makes Acquire an excellent tool to, among others, speedup the process of digital forensic triage. It uses Dissect to gather that information from the raw disk, if possible.
• artifactcollector - The artifactcollector project provides a software that collects forensic artifacts on systems.
• bulk_extractor - Computer forensics tool that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. Because of ignoring the file system structure, the program distinguishes itself in terms of speed and thoroughness.
• Cold Disk Quick Response - Streamlined list of parsers to quickly analyze a forensic image file (dd, E01, .vmdk, etc) and output nine reports.
• CyLR - The CyLR tool collects forensic artifacts from hosts with NTFS file systems quickly, securely and minimizes impact to the host.
• Forensic Artifacts - Digital Forensics Artifact Repository
• ir-rescue - Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
• Live Response Collection - Automated tool that collects volatile data from Windows, OSX, and *nix based operating systems.
• Margarita Shotgun - Command line utility (that works with or without Amazon EC2 instances) to parallelize remote memory acquisition.
• SPECTR3 - Acquire, triage and investigate remote evidence via portable iSCSI readonly access

Incident Management

• Catalyst - A free SOAR system that helps to automate alert handling and incident response processes.
• CyberCPR - Community and commercial incident management tool with Need-to-Know built in to support GDPR compliance while handling sensitive incidents.
• Cyphon - Cyphon eliminates the headaches of incident management by streamlining a multitude of related tasks through a single platform. It receives, processes and triages events to provide an all-encompassing solution for your analytic workflow — aggregating data, bundling and prioritizing alerts, and empowering analysts to investigate and document incidents.
• CORTEX XSOAR - Paloalto security orchestration, automation and response platform with full Incident lifecycle management and many integrations to enhance automations.
• DFTimewolf - A framework for orchestrating forensic collection, processing and data export.
• DFIRTrack - Incident Response tracking application handling one or more incidents via cases and tasks with a lot of affected systems and artifacts.
• Fast Incident Response (FIR) - Cybersecurity incident management platform designed with agility and speed in mind. It allows for easy creation, tracking, and reporting of cybersecurity incidents and is useful for CSIRTs, CERTs and SOCs alike.
• RTIR - Request Tracker for Incident Response (RTIR) is the premier open source incident handling system targeted for computer security teams. We worked with over a dozen CERT and CSIRT teams around the world to help you handle the ever-increasing volume of incident reports. RTIR builds on all the features of Request Tracker.
• Sandia Cyber Omni Tracker (SCOT) - Incident Response collaboration and knowledge capture tool focused on flexibility and ease of use. Our goal is to add value to the incident response process without burdening the user.
• Shuffle - A general purpose security automation platform focused on accessibility.
• threat_note - Lightweight investigation notebook that allows security researchers the ability to register and retrieve indicators related to their research.

Knowledge Bases

• Digital Forensics Artifact Knowledge Base - Digital Forensics Artifact Knowledge Base
• Windows Events Attack Samples - Windows Events Attack Samples
• Windows Registry Knowledge Base - Windows Registry Knowledge Base

Linux Distributions

• The Appliance for Digital Investigation and Analysis (ADIA) - VMware-based appliance used for digital investigation and acquisition and is built entirely from public domain software. Among the tools contained in ADIA are Autopsy, the Sleuth Kit, the Digital Forensics Framework, log2timeline, Xplico, and Wireshark. Most of the system maintenance uses Webmin. It is designed for small-to-medium sized digital investigations and acquisitions. The appliance runs under Linux, Windows, and Mac OS. Both i386 (32-bit) and x86_64 (64-bit) versions are available.
• Computer Aided Investigative Environment (CAINE) - Contains numerous tools that help investigators during their analysis, including forensic evidence collection.
• CCF-VM - CyLR CDQR Forensics Virtual Machine (CCF-VM): An all-in-one solution to parsing collected data, making it easily searchable with built-in common searches, enable searching of single and multiple hosts simultaneously.
• NST - Network Security Toolkit - Linux distribution that includes a vast collection of best-of-breed open source network security applications useful to the network security professional.
• NullSec Linux - Security-focused Linux distribution with 140+ pre-installed forensic and offensive security tools, custom hardened kernel, and integrated incident response workflows.
• PALADIN - Modified Linux distribution to perform various forensics task in a forensically sound manner. It comes with many open source forensics tools included.
• Security Onion - Special Linux distro aimed at network security monitoring featuring advanced analysis tools.
• SANS Investigative Forensic Toolkit (SIFT) Workstation - Demonstrates that advanced incident response capabilities and deep dive digital forensic techniques to intrusions can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.

Linux Evidence Collection

• FastIR Collector Linux - FastIR for Linux collects different artifacts on live Linux and records the results in CSV files.
• MAGNET DumpIt - Fast memory acquisition open source tool for Linux written in Rust. Generate full memory crash dumps of Linux machines.

Log Analysis Tools

• AppCompatProcessor - AppCompatProcessor has been designed to extract additional value from enterprise-wide AppCompat / AmCache data beyond the classic stacking and grepping techniques.
• APT Hunter - APT-Hunter is Threat Hunting tool for windows event logs.
• Chainsaw - Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows event logs.
• Event Log Explorer - Tool developed to quickly analyze log files and other data.
• Event Log Observer - View, analyze and monitor events recorded in Microsoft Windows event logs with this GUI tool.
• Hayabusa - Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool created by the Yamato Security group in Japan.
• Kaspersky CyberTrace - Threat intelligence fusion and analysis tool that integrates threat data feeds with SIEM solutions. Users can immediately leverage threat intelligence for security monitoring and incident report (IR) activities in the workflow of their existing security operations.
• Log Parser Lizard - Execute SQL queries against structured log data: server logs, Windows Events, file system, Active Directory, log4net logs, comma/tab separated text, XML or JSON files. Also provides a GUI to Microsoft LogParser 2.2 with powerful UI elements: syntax editor, data grid, chart, pivot table, dashboard, query manager and more.
• Lorg - Tool for advanced HTTPD logfile security analysis and forensics.
• Logdissect - CLI utility and Python API for analyzing log files and other data.
• NullSec LogReaper - High-speed log analysis and forensics tool with multi-format parsing, pattern matching, timeline reconstruction and anomaly detection for incident response.
• LogonTracer - Tool to investigate malicious Windows logon by visualizing and analyzing Windows event log.

Memory Analysis Tools

• AVML - A portable volatile memory acquisition tool for Linux.
• Evolve - Web interface for the Volatility Memory Forensics Framework.
• inVtero.net - Advanced memory analysis for Windows x64 with nested hypervisor support.
• LiME - Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD.
• MalConfScan - MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a function to list strings to which malicious code refers.
• Memoryze - Free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis.
• Memoryze for Mac - Memoryze for Mac is Memoryze but then for Macs. A lower number of features, however.
• [MemProcFS] (https://github.com/ufrisk/MemProcFS) - MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.
• Orochi - Orochi is an open source framework for collaborative forensic memory dump analysis.
• Rekall - Open source tool (and library) for the extraction of digital artifacts from volatile memory (RAM) samples.
• Volatility - Advanced memory forensics framework.
• Volatility 3 - The volatile memory extraction framework (successor of Volatility)
• VolatilityBot - Automation tool for researchers cuts all the guesswork and manual tasks out of the binary extraction phase, or to help the investigator in the first steps of performing a memory analysis investigation.

Memory Imaging Tools

• Belkasoft Live RAM Capturer - Tiny free forensic tool to reliably extract the entire content of the computer’s volatile memory – even if protected by an active anti-debugging or anti-dumping system.
• Linux Memory Grabber - Script for dumping Linux memory and creating Volatility profiles.
• MAGNET DumpIt - Fast memory acquisition tool for Windows (x86, x64, ARM64). Generate full memory crash dumps of Windows machines.
• Magnet RAM Capture - Free imaging tool designed to capture the physical memory of a suspect’s computer. Supports recent versions of Windows.
• OSForensics - Tool to acquire live memory on 32-bit and 64-bit systems. A dump of an individual process’s memory space or physical memory dump can be done.

OSX Evidence Collection

• Knockknock - Displays persistent items(scripts, commands, binaries, etc.) that are set to execute automatically on OSX.
• macOS Artifact Parsing Tool (mac_apt) - Plugin based forensics framework for quick mac triage that works on live machines, disk images or individual artifact files.
• OSX Auditor - Free Mac OS X computer forensics tool.
• OSX Collector - OSX Auditor offshoot for live response.
• The ESF Playground - A tool to view the events in Apple Endpoint Security Framework (ESF) in real time.

Other Lists

• Awesome Event IDs - Collection of Event ID resources useful for Digital Forensics and Incident Response.
• Awesome Forensics - A curated list of awesome forensic analysis tools and resources.
• Didier Stevens Suite - Tool collection
• Eric Zimmerman Tools - An updated list of forensic tools created by Eric Zimmerman, an instructor for SANS institute.
• List of various Security APIs - Collective list of public JSON APIs for use in security.

Other Tools

• Cortex - Cortex allows you to analyze observables such as IP and email addresses, URLs, domain names, files or hashes one by one or in bulk mode using a Web interface. Analysts can also automate these operations using its REST API.
• Crits - Web-based tool which combines an analytic engine with a cyber threat database.
• Diffy - DFIR tool developed by Netflix's SIRT that allows an investigator to quickly scope a compromise across cloud instances (Linux instances on AWS, currently) during an incident and efficiently triaging those instances for followup actions by showing differences against a baseline.
• domfind - Python DNS crawler for finding identical domain names under different TLDs.
• Fileintel - Pull intelligence per file hash.
• HELK - Threat Hunting platform.
• Hindsight - Internet history forensics for Google Chrome/Chromium.
• Hostintel - Pull intelligence per host.
• IPASIS - Real-time IP reputation and email validation API for investigating suspicious interactions. Returns an Interaction Trust Score (0-100) combining VPN/proxy/Tor detection with email risk assessment in a single API call.
• imagemounter - Command line utility and Python package to ease the (un)mounting of forensic disk images.
• Kansa - Modular incident response framework in PowerShell.
• MFT Browser - MFT directory tree reconstruction & record info.
• Munin - Online hash checker for VirusTotal and other services.
• PowerSponse - PowerSponse is a PowerShell module focused on targeted containment and remediation during security incident response.
• PyaraScanner - Very simple multi-threaded many-rules to many-files YARA scanning Python script for malware zoos and IR.

Playbooks

• AWS Incident Response Runbook Samples - AWS IR Runbook Samples meant to be customized per each entity using them. The three samples are: "DoS or DDoS attack", "credential leakage", and "unintended access to an Amazon S3 bucket".
• Counteractive Playbooks - Counteractive PLaybooks collection.
• GuardSIght Playbook Battle Cards - A collection of Cyber Incident Response Playbook Battle Cards
• IRM - Incident Response Methodologies by CERT Societe Generale.
• PagerDuty Incident Response Documentation - Documents that describe parts of the PagerDuty Incident Response process. It provides information not only on preparing for an incident, but also what to do during and after. Source is available on GitHub.
• Phantom Community Playbooks - Phantom Community Playbooks for Splunk but also customizable for other use.
• ThreatHunter-Playbook - Playbook to aid the development of techniques and hypothesis for hunting campaigns.

Process Dump Tools

• Microsoft ProcDump - Dumps any running Win32 processes memory image on the fly.
• PMDump - Tool that lets you dump the memory contents of a process to a file without stopping the process.

Sandboxing/Reversing Tools

• Any Run - Interactive online malware analysis service for dynamic and static research of most types of threats using any environment.
• CAPA - detects capabilities in executable files. You run it against a PE, ELF, .NET module, or shellcode file and it tells you what it thinks the program can do.
• CAPEv2 - Malware Configuration And Payload Extraction.
• Cuckoo - Open Source Highly configurable sandboxing tool.
• Cuckoo-modified - Heavily modified Cuckoo fork developed by community.
• Cuckoo-modified-api - Python library to control a cuckoo-modified sandbox.
• Cutter - Free and Open Source Reverse Engineering Platform powered by rizin.
• Ghidra - Software Reverse Engineering Framework.
• Hybrid-Analysis - Free powerful online sandbox by CrowdStrike.
• Intezer - Intezer Analyze dives into Windows binaries to detect micro-code similarities to known threats, in order to provide accurate yet easy-to-understand results.
• Joe Sandbox (Community) - Joe Sandbox detects and analyzes potential malicious files and URLs on Windows, Android, Mac OS, Linux, and iOS for suspicious activities; providing comprehensive and detailed analysis reports.
• Mastiff - Static analysis framework that automates the process of extracting key characteristics from a number of different file formats.
• Metadefender Cloud - Free threat intelligence platform providing multiscanning, data sanitization and vulnerability assessment of files.
• Radare2 - Reverse engineering framework and command-line toolset.
• Reverse.IT - Alternative domain for the Hybrid-Analysis tool provided by CrowdStrike.

Scanner Tools

• Fenrir - Simple IOC scanner. It allows scanning any Linux/Unix/OSX system for IOCs in plain bash. Created by the creators of THOR and LOKI.
• LOKI - Free IR scanner for scanning endpoint with yara rules and other indicators(IOCs).
• Spyre - Simple YARA-based IOC scanner written in Go

Timeline Tools

• Aurora Incident Response - Platform developed to build easily a detailed timeline of an incident.
• Highlighter - Free Tool available from Fire/Mandiant that will depict log/text file that can highlight areas on the graphic, that corresponded to a key word or phrase. Good for time lining an infection and what was done post compromise.
• Morgue - PHP Web app by Etsy for managing postmortems.
• Plaso - a Python-based backend engine for the tool log2timeline.
• Timesketch - Open source tool for collaborative forensic timeline analysis.

Videos

• The Future of Incident Response - Presented by Bruce Schneier at OWASP AppSecUSA 2015.

Windows Evidence Collection

• AChoir - Framework/scripting tool to standardize and simplify the process of scripting live acquisition utilities for Windows.
• Crowd Response - Lightweight Windows console application designed to aid in the gathering of system information for incident response and security engagements. It features numerous modules and output formats.
• Cyber Triage - Cyber Triage has a lightweight collection tool that is free to use. It collects source files (such as registry hives and event logs), but also parses them on the live host so that it can also collect the executables that the startup items, scheduled, tasks, etc. refer to. It's output is a JSON file that can be imported into the free version of Cyber Triage. Cyber Triage is made by Sleuth Kit Labs, which also makes Autopsy.
• DFIR ORC - DFIR ORC is a collection of specialized tools dedicated to reliably parse and collect critical artifacts such as the MFT, registry hives or event logs. DFIR ORC collects data, but does not analyze it: it is not meant to triage machines. It provides a forensically relevant snapshot of machines running Microsoft Windows. The code can be found on GitHub.
• FastIR Collector - Tool that collects different artifacts on live Windows systems and records the results in csv files. With the analyses of these artifacts, an early compromise can be detected.
• Fibratus - Tool for exploration and tracing of the Windows kernel.
• Hoarder - Collecting the most valuable artifacts for forensics or incident response investigations.
• IREC - All-in-one IR Evidence Collector which captures RAM Image, $MFT, EventLogs, WMI Scripts, Registry Hives, System Restore Points and much more. It is FREE, lightning fast and easy to use.
• Invoke-LiveResponse - Invoke-LiveResponse is a live response tool for targeted collection.
• IOC Finder - Free tool from Mandiant for collecting host system data and reporting the presence of Indicators of Compromise (IOCs). Support for Windows only. No longer maintained. Only fully supported up to Windows 7 / Windows Server 2008 R2.