
DFIR-Companion
DFIR forensics companion server + capture extension
ai-securitydefensive-toolsdigital-forensics+9
3522h 42m ago

DFIR forensics companion server + capture extension

Clusters and elements to attach to MISP events or attributes (like threat actors)

CarbonBlack hunting queries to detect PrintNightmare (CVE-2021-1675) exploitation via file, module load, and process events, based on Sigma rules.

Sigma rule for detecting exploitation of CVE-2022-30190 (Follina) via Windows process creation events, enabling SOC teams to identify malicious…


Extracts selected MISP attributes, including IP addresses, URLs, and hashes, into reusable output files.