
DFIR-Companion
DFIR forensics companion server + capture extension
ai-securitydefensive-toolsdigital-forensics+9
353 days ago

DFIR forensics companion server + capture extension


Clusters and elements to attach to MISP events or attributes (like threat actors)

Sigma rule for detecting exploitation of CVE-2022-30190 (Follina) via Windows process creation events, enabling SOC teams to identify malicious…

Extracts selected MISP attributes, including IP addresses, URLs, and hashes, into reusable output files.

CarbonBlack hunting queries to detect PrintNightmare (CVE-2021-1675) exploitation via file, module load, and process events, based on Sigma rules.