dfir-automation

Automate the creation of a lab environment complete with security tooling and logging best practices

A little tool to play with Azure Identity - Azure Active Directory lab creation tool

Graph Visualization for windows event logs

Rip Raw is a small tool to analyse the memory of compromised Linux systems.

Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.

Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - https://circl.lu/services/hashlookup/

Fast lookup server for NSRL and other hash database used in digital forensic

A collection of Terraform and Ansible scripts that automatically (and quickly) deploys a small Velociraptor R&D lab.

Toolset to analyze disks encrypted with McAFee FDE technology

ActiveMime File Format Documentation

Factual rules are YARA rules to find legitimate software on raw disk acquisition.

Minion rules for DFIR work.

Cortex-Analyzers Modified - SecTeam/CERT/SOC Security orchestration tools on steroids

A Python, Boto3 script that leverages a forensic volume to attach & mount to a selected instance, run a memory dump, unmount and detach from the selected instance and finally attach & mount to a Forensic Workstation

Simple Imager has been created for performing live acquisition of Windows based systems in a forensically sound manner

Manage loki scans over a large network.

This script is designed to pull data from the carbon black cloud. One disadvantage of the CBC GUI is the inability to see the command line for each process in bulk. Instead, you need to click on each process individually. This spits out the command line so you can quickly spot evil.

A collection of Terraform and Ansible scripts that automatically (and quickly) deploys a small HELK R&D lab in Azure.

File Watcher - Powershell based file activity monitoring tool

Small Incident Response Powershell script that collects various data from the system.Good alternative to run on a system while waiting for an approved AV scan( or instead of a scan)

splits a URL into individual components, unescapes arguments, and performs light calculations for manual or automated analysis

Faster & Better Way to analyze the EML Files

A Python, Boto3 script that shuts down a selected instance, detaches the instance, generates a snapshot volume and then attaches and mounts both volumes to a workstation

Sabonis, a Digital Forensics and Incident Response pivoting tool

Ingest and query NIST NSRL Reference Data Sets in Elasticsearch with Python tools and libraries.

Easy automated vagrant provisioning of Windows 10 with flarevm tools installed for Digital Forensics and Malware Analysis Lab.

DFIR Lab in AWS

Confirm file type by matching the magic signature ("number").

CrowdStrike API Client Library

Search for given file hash