Tools

anttikurittu/kirjuri

Kirjuri is a web application for managing cases and physical forensic evidence items.

snovvcrash/usbrip

Tracking history of USB events on GNU/Linux

google/stenographer

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those…

salesforce/hassh

HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be…

gamelinux/passivedns

A network sniffer that logs all DNS server replies for use in a passive DNS setup

cyb3rfox/aurora-incident-response

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders

mkorman90/regipy

Regipy is an os independent python library for parsing offline registry hives

travisfoley/dfirtriage

Digital forensic acquisition tool for Windows based incident response.

nccgroup/detectwindowscopyonwriteforapi

Enumerate various traits from Windows processes as an aid to threat hunting

joeavanzato/trawler

PowerShell script helping Incident Responders discover potential adversary persistence mechanisms.

mubix/cve-2021-44228-log4shell-hashes

Hashes for vulnerable LOG4J versions

spyre-project/spyre

simple YARA-based IOC scanner

lifars/gargamel

A forensic evidence acquirer

neo23x0/mongobleed-detector

Detection Script for MongoBleed Exploitation

romaissaadjailia/get-applockereventlog

This is a repo for fetching Applocker event log by parsing the win-event log