Top 127 dfir open source projects

Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.

✭ 152

python dfir incident-response threat-hunting

Thehive4py

Python API Client for TheHive

✭ 143

python api open-source free api-client dfir incident-response free-software digital-forensics

Logontracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log

✭ 1,914

javascript python HTML Dockerfile CSS security visualization dfir active-directory blueteam event-log

Mthc

All-in-one bundle of MISP, TheHive and Cortex

✭ 134

dfir incident-response threat-hunting threat-intelligence

Timesketch

Collaborative forensic timeline analysis

✭ 1,795

python Vue Jupyter Notebook javascript shell SCSS security analysis timeline dfir forensics

Cirtkit

Tools for the Computer Incident Response Team 💻

✭ 117

python malware-analysis dfir

Cacador

Indicator Extractor

✭ 115

go golang security dfir

Invoke Liveresponse

Invoke-LiveResponse

✭ 115

powershell dfir forensics incident-response

Lolbas

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

✭ 1,506

XSLT redteam dfir blueteam purpleteam lolbins lolscripts living-off-the-land

Kiewtai

A port of Kaitai to the Hiew hex editor

✭ 108

c reverse-engineering dfir binary-analysis

Awesome Forensics

A curated list of awesome forensic analysis tools and resources

✭ 1,775

open-source free dfir digital-forensics computer-forensics forensic-analysis

Threathunt

ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.

✭ 92

powershell dfir incident-response threat-hunting blueteam

Malice

VirusTotal Wanna Be - Now with 100% more Hipster

✭ 1,253

go golang docker elasticsearch cloud malware infosec cybersecurity malware-analysis dfir malware-research antivirus virustotal

Evtx Attack Samples

Windows Events Attack Samples

✭ 1,243

powershell dataset dfir threat-hunting mitre-attack

Sysmon Modular

A repository of sysmon configuration modules

✭ 1,229

powershell security-tools modular dfir threat-hunting mitre-attack sysmon

Signature Base

Signature base for my scanner tools

✭ 1,212

scanner hash ioc dfir threat-hunting threat-intelligence yara signature

Lw Yara

Yara Ruleset for scanning Linux servers for shells, spamming, phishing and other webserver baddies

✭ 78

dfir yara signature malware-detection

Etl Parser

Event Trace Log file parser in pure Python

✭ 66

python windows dfir forensics

Mimir

Smart OSINT collection of common IOC types

✭ 63

python machine-learning osint dfir

Autotimeliner

Automagically extract forensic timeline from volatile memory dump

✭ 54

python dfir forensics

Scripting

PS / Bash / Python / Other scripts For FUN!

✭ 47

python powershell bash visualization detection exploit memory dfir incident-response binary-analysis malware-detection memory-hacking

Yeti

Your Everyday Threat Intelligence

✭ 1,037

python infosec dfir threat-hunting threatintel intelligence

Historicprocesstree

An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view.

✭ 46

python dfir incident-response treeview

Malcom

Malcom - Malware Communications Analyzer

✭ 988

python malware infosec malware-analysis dfir threat-intelligence pcap

Beagle

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

✭ 976

python security graph dfir incident-response threat-hunting digital-forensics

Forensic Tools

CIRCL system forensic tools or a jumble of tools to support forensic

✭ 27

python dfir digital-forensics

Artifacts

📇 Digital Forensics Artifact Repository (forensicanalysis edition)

✭ 21

dfir digital-forensics

Cortex4py

Python API Client for Cortex

✭ 22

python api open-source api-client dfir incident-response free-software

Threathunting

A Splunk app mapped to MITRE ATT&CK to guide your threat hunts

✭ 738

python dfir threat-hunting mitre-attack

Memlabs

Educational, CTF-styled labs for individuals interested in Memory Forensics

✭ 696

shell security windows ctf cybersecurity dfir forensics digital-forensics

My Arsenal Of Aws Security Tools

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

✭ 6,464

shell Makefile security cloud security-tools aws-lambda dfir incident-response iam auditing cloudtrail aws-infrastructure aws-inventory

Cortex

Cortex: a Powerful Observable Analysis and Active Response Engine

✭ 676

python scala api open-source rest free analysis engine analyzer dfir incident-response free-software observable response digital-forensics

Cyberchef Recipes

A list of cyber-chef recipes and curated links

✭ 619

malware regular-expression dfir incident-response

Hindsight

Web browser forensics for Google Chrome/Chromium

✭ 589

python chrome dfir forensics google-chrome

Diffy

Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

✭ 555

python security dfir forensics

Turbinia

Automation and Scaling of Digital Forensics Tools

✭ 461

python security cloud dfir forensics security-automation

Threatingestor

Extract and aggregate threat intelligence.

✭ 439

python security-tools osint ioc dfir threat-hunting threat-intelligence malware-research yara threatintel

Awesome Incident Response

A curated list of tools for incident response