fox-it Goto Github PK

aclpwn.py

Active Directory ACL exploitation with BloodHound

acquire

acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.

aws-lambda-kinesis-windowseventlog

AWS lambda to transform the json from AWS kinesis agent to useful json documents for elasticsearch

blister-research

Scripts, YARA and IOCs from our research on the Blister malware 🩹

bloodhound-import

Python based BloodHound data importer

bro-scripts

Bro-IDS scripts

cisco-ios-xe-implant-detection

Cisco IOS XE implant scanning & detection (CVE-2023-20198, CVE-2023-20273)

citrix-netscaler-triage

Dissect triage script for Citrix NetScaler devices

cobaltstrike-beacon-data

Open Dataset of Cobalt Strike Beacon metadata (2018-2022)

cobaltstrike-extraneous-space

Historical list of {Cobalt Strike,NanoHTTPD} servers

cryptophp

CryptoPHP Indicators of Compromise

cve-2019-1040-scanner

danderspritz-evtx

Parse evtx files and detect use of the DanderSpritz eventlogedit module

decrypt-orchestratorsecretvariables

decrypt-tfssecretvariables

dissect

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

dissect-docs

Dissect documentation project

dissect-workflow-templates

Workflow templates for the dissect projects

dissect.archive

A Dissect module implementing parsers for various archive and backup formats.

dissect.btrfs

A Dissect module implementing a parser for the btrfs file system.

dissect.cim

A Dissect module implementing a parser for the Windows Common Information Model (CIM) database, used in the Windows operating system.

dissect.clfs

A Dissect module implementing a parser for the CLFS (Common Log File System) file system of Windows.

dissect.cobaltstrike

Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles

dissect.contrib

This project is a meta package. It reserves the namespace for Dissect packages made by external contributors.

dissect.cstruct

A Dissect module implementing a parser for C-like structures.

dissect.cstruct_legacy

A no-nonsense c-like structure parsing library for Python

dissect.disc

A Dissect module implementing a parser for file systems commonly used on optical media, such as ISO9660 and several extensions.

dissect.esedb

A Dissect module implementing a parser for Microsofts Extensible Storage Engine Database (ESEDB), used for example in Active Directory, Exchange and Windows Update.

dissect.etl

A Dissect module implementing a parser for Event Trace Log (ETL) files, used by the Windows operating system to log kernel events.

dissect.eventlog

A Dissect module implementing parsers for the Windows EVT, EVTX and WEVT log file formats.