shabeebpm Goto Github PK

authlogparser

AuthLogParser is a powerful DFIR tool designed specifically for analyzing Linux authentication logs, commonly known as auth.log

awesome-forensics

A curated list of awesome forensic analysis tools and resources

awesome-incident-response

A curated list of tools for incident response

cb-threat-hunting

Security operations queries and actions with CarbonBlack Response. Forked from @0xAnalyst

cbr-queries

Collection of useful, up to date, Carbon Black Response Queries

css-exchange

Exchange Server support tools and scripts

device-wipers

Shell scripts to wipe HDDs, SSDs and USB storage.

dfir-resources

Some important DFIR Resources

dfir-tools

This is the One Stop place where you can find almost all of your Tools of Requirements in DFIR

digital-forensics-script-for-linux

Advanced Bash script designed for conducting digital forensics on Linux systems

easy_linux_ir

This repository contains a script which will extract the artefacts for incident response and live forensics in Linux environments

fastir_collector_linux

freki

:wolf: Malware analysis platform

hunt-detect-prevent

Lists of sources and utilities utilized to hunt, detect and prevent evildoers.

ir-flash

Automated Script to capture forensic evidences (logs) from an Windows EndPoint.

kql

Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.

kql-threat-hunting-queries

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

linux-incident-response

practical toolkit for cybersecurity and IT professionals. It features a detailed Linux cheatsheet for incident response

persistencesniper

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte

power-forensics

Power-Forensics is the Best Friend for Incident Responders to perform IR and collect evidences for Linux based host

prometheus

prometheus-course

Course files for Monitoring and Alerting with Prometheus

rules

Repository of yara rules

splunk4dfir

harness the power of Splunk for your investigations

whatmail

WhatMail is a command-line tool that analyzes the header of an email and provides detailed information about various fields.

windows-forensic-artifacts

Handbook of windows forensic artifacts across multiple Windows version with interpretation tips with some examples. Work in progress!