Top 50 Awesome List

meirwah/awesome-incident-response

Security  14 days ago  4.6k
A curated list of tools for incident response
View byDAY/WEEK/README
View on Github

Oct 11th

IR Tools Collection

All-In-One Tools

  • Fleetdmstars494 - State of the art host monitoring platform tailored for security experts. Leveraging Facebook's battle-tested osquery project, Fleetdm delivers continuous updates, features and fast answers to big questions.
  • IR Tools Collection

    Evidence Collection

  • UACstars106 - UAC (Unix-like Artifacts Collector) is a Live Response collection tool for Incident Response that makes use of built-in tools to automate the collection of Unix-like systems artifacts. Supported systems: AIX, FreeBSD, Linux, macOS, NetBSD, Netscaler, OpenBSD and Solaris.
  • IR Tools Collection

    Other Tools

  • traceroute-circlstars36 - Extended traceroute to support the activities of CSIRT (or CERT) operators. Usually CSIRT team have to handle incidents based on IP addresses received. Created by Computer Emergency Response Center Luxembourg.
  • MFT Browserstars163 - MFT directory tree reconstruction & record info.
  • IR Tools Collection

    Playbooks

  • IR Workflow Gallery - Different generic incident response workflows, e.g. for malware outbreak, data theft, unauthorized access,... Every workflow consists of seven steps: prepare, detect, analyze, contain, eradicate, recover, post-incident handling. The workflows are online available or for download.
  • Sep 15th

    IR Tools Collection

    Windows Evidence Collection

  • KAPE - Kroll Artifact Parser and Extractor (KAPE) by Eric Zimmerman. A triage tool that finds the most prevalent digital artifacts and then parses them quickly. Great and thorough when time is of the essence.
  • LOKIstars2.2k - Free IR scanner for scanning endpoint with yara rules and other indicators(IOCs).
  • DFIR ORC - DFIR ORC is a collection of specialized tools dedicated to reliably parse and collect critical artifacts such as the MFT, registry hives or event logs. DFIR ORC collects data, but does not analyze it: it is not meant to triage machines. It provides a forensically relevant snapshot of machines running Microsoft Windows. The code can be found on GitHubstars222.
  • FastIR Collectorstars465 - Tool that collects different artifacts on live Windows systems and records the results in csv files. With the analyses of these artifacts, an early compromise can be detected.
  • MEERKATstars311 - PowerShell-based triage and threat hunting for Windows.
  • IR Tools Collection

    Adversary Emulation

  • Atomic Red Team (ART)stars5.2k - Small and highly portable detection tests mapped to the MITRE ATT&CK Framework.
  • IR Tools Collection

    Books

  • Introduction to DFIR - By Scott J. Roberts.
  • IR Tools Collection

    Communities

  • Digital Forensics Discord Server - Community of 8,000+ working professionals from Law Enforcement, Private Sector, and Forensic Vendors. Additionally, plenty of students and hobbyists! Guide here.
  • SANS DFIR mailing list - Mailing list by SANS for DFIR.
  • IR Tools Collection

    Linux Distributions

  • PALADIN - Modified Linux distribution to perform various forensics task in a forensically sound manner. It comes with many open source forensics tools included.
  • IR Tools Collection

    Linux Evidence Collection

  • FastIR Collector Linuxstars147 - FastIR for Linux collects different artifacts on live Linux and records the results in CSV files.
  • IR Tools Collection

    Log Analysis Tools

  • Log Parser Lizard - Execute SQL queries against structured log data: server logs, Windows Events, file system, Active Directory, log4net logs, comma/tab separated text, XML or JSON files. Also provides a GUI to Microsoft LogParser 2.2 with powerful UI elements: syntax editor, data grid, chart, pivot table, dashboard, query manager and more.
  • IR Tools Collection

    Memory Imaging Tools

  • OSForensics - Tool to acquire live memory on 32-bit and 64-bit systems. A dump of an individual process’s memory space or physical memory dump can be done.
  • IR Tools Collection

    Other Tools

  • Kansastars1.2k - Modular incident response framework in PowerShell.
  • Muninstars584 - Online hash checker for VirusTotal and other services.
  • PyaraScannerstars19 - Very simple multi-threaded many-rules to many-files YARA scanning Python script for malware zoos and IR.
  • IR Tools Collection

    Sandboxing/Reversing Tools

  • Metadefender Cloud - Free threat intelligence platform providing multiscanning, data sanitization and vulnerability assessment of files.
  • Jul 26th

    IR Tools Collection

    Incident Management

  • DFTimewolfstars162 - A framework for orchestrating forensic collection, processing and data export.
  • Shufflestars593 - A general purpose security automation platform focused on accessibility.
  • IR Tools Collection

    Other Tools

  • Raccinestars753 - A Simple Ransomware Protection
  • sysmon-configstars3.2k - Sysmon configuration file template with default high-quality event tracing
  • sysmon-modularstars1.6k - A repository of sysmon configuration modules
  • Jul 25th

    IR Tools Collection

    Books

  • Intelligence-Driven Incident Response - By Scott J. Roberts, Rebekah Brown.
  • Jul 9th

    IR Tools Collection

    Log Analysis Tools

  • Event Log Observer - View, analyze and monitor events recorded in Microsoft Windows event logs with this GUI tool.
  • Jun 24th

    IR Tools Collection

    Playbooks

  • AWS Incident Response Runbook Samples - AWS IR Runbook Samples meant to be customized per each entity using them. The three samples are: "DoS or DDoS attack", "credential leakage", and "unintended access to an Amazon S3 bucket".
  • Jun 15th

    IR Tools Collection

    All-In-One Tools

  • Flarestars3.1k - A fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing.
  • Kuiperstars357 - Digital Forensics Investigation Platform
  • Velociraptorstars956 - Endpoint visibility and collection tool
  • IR Tools Collection

    Evidence Collection

  • artifactcollectorstars83 - The artifactcollector project provides a software that collects forensic artifacts on systems.
  • Forensic Artifactsstars639 - Digital Forensics Artifact Repository
  • Live Response Collection - Automated tool that collects volatile data from Windows, OSX, and *nix based operating systems.
  • IR Tools Collection

    Knowledge Bases

  • Digital Forensics Artifact Knowledge Basestars26 - Digital Forensics Artifact Knowledge Base
  • Windows Events Attack Samplesstars1.5k - Windows Events Attack Samples
  • Windows Registry Knowledge Basestars79 - Windows Registry Knowledge Base
  • IR Tools Collection

    Log Analysis Tools

  • LogonTracerstars1.9k - Tool to investigate malicious Windows logon by visualizing and analyzing Windows event log.
  • Sigmastars4.2k - Generic signature format for SIEM systems already containing an extensive ruleset.
  • IR Tools Collection

    Memory Analysis Tools

  • Volatility 3stars656 - The volatile memory extraction framework (successor of Volatility)
  • IR Tools Collection

    Other Lists

  • Awesome Forensicsstars1.7k - A curated list of awesome forensic analysis tools and resources.
  • Didier Stevens Suitestars1k - Tool collection
  • IR Tools Collection

    Playbooks

  • ThreatHunter-Playbookstars2.8k - Playbook to aid the development of techniques and hypothesis for hunting campaigns.
  • IR Tools Collection

    Sandboxing/Reversing Tools

  • Ghidrastars29.3k - Software Reverse Engineering Framework.
  • Rizinstars1.1k - UNIX-like reverse engineering framework and command-line toolset
  • IR Tools Collection

    Scanner Tools

  • Fenrirstars339 - Simple IOC scanner. It allows scanning any Linux/Unix/OSX system for IOCs in plain bash. Created by the creators of THOR and LOKI.
  • LOKIstars2.2k - Free IR scanner for scanning endpoint with yara rules and other indicators(IOCs).
  • Spyrestars103 - Simple YARA-based IOC scanner written in Go
  • IR Tools Collection

    Windows Evidence Collection

  • Hoarderstars100 - Collecting the most valuable artifacts for forensics or incident response investigations.
  • Jun 9th

    IR Tools Collection

    Incident Management

  • DFIRTrackstars310 - Incident Response tracking application handling one or more incidents via cases and tasks with a lot of affected systems and artifacts.
  • Jun 1st

    IR Tools Collection

    Log Analysis Tools

  • APT Hunterstars428 - APT-Hunter is Threat Hunting tool for windows event logs.
  • Event Log Explorer - Tool developed to quickly analyze log files and other data.
  • Zircolitestars183 - A standalone and fast SIGMA-based detection tool for EVTX or JSON.
  • IR Tools Collection

    Memory Analysis Tools

  • Rekall - Open source tool (and library) for the extraction of digital artifacts from volatile memory (RAM) samples.
  • IR Tools Collection

    Playbooks

  • Counteractive Playbooks - Counteractive PLaybooks collection.
  • GuardSIght Playbook Battle Cardsstars59 - A collection of Cyber Incident Response Playbook Battle Cards
  • Phantom Community Playbooksstars303 - Phantom Community Playbooks for Splunk but also customizable for other use.
  • IR Tools Collection

    Timeline Tools

  • Aurora Incident Responsestars254 - Platform developed to build easily a detailed timeline of an incident.
  • IR Tools Collection

    Books

  • Incident Response & Computer Forensics, Third Edition - The definitive guide to incident response.
  • The Practice of Network Security Monitoring: Understanding Incident Detection and Response - Richard Bejtlich's book on IR.
  • Applied Incident Response - Steve Anson's book on Incident Response.
  • Operator Handbook: Red Team + OSINT + Blue Team Reference - Great reference for incident responders.
  • May 17th

    IR Tools Collection

    Sandboxing/Reversing Tools

  • Yomi - Free MultiSandbox managed and hosted by Yoroi.
  • Jan 25th

    IR Tools Collection

    All-In-One Tools

  • GRR Rapid Responsestars3.9k - Incident response framework focused on remote live forensics. It consists of a python agent (client) that is installed on target systems, and a python server infrastructure that can manage and talk to the agent. Besides the included Python API client, PowerGRRstars49 provides an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.
  • Oct 30th, 2020

    IR Tools Collection

    Communities

  • augmentd - Community driven site providing a list of searches that can be implemented in and executed with a variety of common security tools.
  • IR Tools Collection

    Sandboxing/Reversing Tools

  • Reverse.IT - Alternative domain for the Hybrid-Analysis tool provided by CrowdStrike.
  • Oct 28th, 2020

    IR Tools Collection

    Other Tools

  • rastrea2rstars180 - Allows one to scan disks and memory for IOCs using YARA on Windows, Linux and OS X.
  • IR Tools Collection

    Sandboxing/Reversing Tools

  • Cuckoostars4.8k - Open Source Highly configurable sandboxing tool.
  • CAPEv2stars556 - Malware Configuration And Payload Extraction.
  • IR Tools Collection

    Windows Evidence Collection

  • IOC Finder - Free tool from Mandiant for collecting host system data and reporting the presence of Indicators of Compromise (IOCs). Support for Windows only. No longer maintained. Only fully supported up to Windows 7 / Windows Server 2008 R2.
  • RegRipperstars187 - Open source tool, written in Perl, for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis.
  • IR Tools Collection

    Process Dump Tools

  • Microsoft ProcDump - Dumps any running Win32 processes memory image on the fly.
  • IR Tools Collection

    OSX Evidence Collection

  • Knockknock - Displays persistent items(scripts, commands, binaries, etc.) that are set to execute automatically on OSX.
  • IR Tools Collection

    Memory Analysis Tools

  • WindowsSCOPE - Memory forensics and reverse engineering tool used for analyzing volatile memory offering the capability of analyzing the Windows kernel, drivers, DLLs, and virtual and physical memory.
  • IR Tools Collection

    Incident Management

  • CORTEX XSOAR - Paloalto security orchestration, automation and response platform with full Incident lifecycle management and many integrations to enhance automations.
  • Sandia Cyber Omni Tracker (SCOT)stars219 - Incident Response collaboration and knowledge capture tool focused on flexibility and ease of use. Our goal is to add value to the incident response process without burdening the user.
  • IR Tools Collection

    All-In-One Tools

  • Limacharlie - Endpoint security platform composed of a collection of small projects all working together that gives you a cross-platform (Windows, OSX, Linux, Android and iOS) low-level environment for managing and pushing additional modules into memory to extend its functionality.
  • Oct 16th, 2020

    IR Tools Collection

    Memory Analysis Tools

  • Memoryze for Mac - Memoryze for Mac is Memoryze but then for Macs. A lower number of features, however.
  • Jul 23rd, 2020

    IR Tools Collection

    Memory Analysis Tools

  • AVMLstars429 - A portable volatile memory acquisition tool for Linux.
  • May 13th, 2020

    IR Tools Collection

    Log Analysis Tools

  • AppCompatProcessorstars149 - AppCompatProcessor has been designed to extract additional value from enterprise-wide AppCompat / AmCache data beyond the classic stacking and grepping techniques.
  • IR Tools Collection

    Sandboxing/Reversing Tools

  • Cutterstars9.8k - Reverse engineering platform powered by Radare2.
  • Radare2stars15.1k - Reverse engineering framework and command-line toolset.
  • Apr 6th, 2020

    IR Tools Collection

    Evidence Collection

  • CyLRstars404 - The CyLR tool collects forensic artifacts from hosts with NTFS file systems quickly, securely and minimizes impact to the host.
  • IR Tools Collection

    Windows Evidence Collection

  • Invoke-LiveResponsestars120 - Invoke-LiveResponse is a live response tool for targeted collection.
  • IRTriagestars104 - Incident Response Triage - Windows Evidence Collection for Forensic Analysis.
  • IR Tools Collection

    Other Tools

  • PowerSponsestars30 - PowerSponse is a PowerShell module focused on targeted containment and remediation during security incident response.
  • Mar 11th, 2020

    IR Tools Collection

    Sandboxing/Reversing Tools

  • StringSifterstars517 - A machine learning tool that ranks strings based on their relevance for malware analysis.
  • Jan 18th, 2020

    IR Tools Collection

    Communities

  • Slack DFIR channel - Slack DFIR Communitiy channel - Signup here.
  • Oct 31st, 2019

    IR Tools Collection

    Other Lists

  • Eric Zimmerman Tools - An updated list of forensic tools created by Eric Zimmerman, an instructor for SANS institute.
  • Oct 26th, 2019

    IR Tools Collection

    Memory Analysis Tools

  • MalConfScanstars363 - MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a function to list strings to which malicious code refers.
  • Sep 2nd, 2019

    IR Tools Collection

    Sandboxing/Reversing Tools

  • AMAaaS - Android Malware Analysis as a Service, executed in a native Android environment.
  • Any Run - Interactive online malware analysis service for dynamic and static research of most types of threats using any environment.
  • Hybrid-Analysis - Free powerful online sandbox by CrowdStrike.
  • Intezer - Intezer Analyze dives into Windows binaries to detect micro-code similarities to known threats, in order to provide accurate yet easy-to-understand results.
  • Joe Sandbox (Community) - Joe Sandbox detects and analyzes potential malicious files and URLs on Windows, Android, Mac OS, Linux, and iOS for suspicious activities; providing comprehensive and detailed analysis reports.
  • Valkyrie Comodo - Valkyrie uses run-time behavior and hundreds of features from a file to perform analysis.
  • Jun 3rd, 2019

    IR Tools Collection

    Log Analysis Tools

  • Kaspersky CyberTrace - Threat intelligence fusion and analysis tool that integrates threat data feeds with SIEM solutions. Users can immediately leverage threat intelligence for security monitoring and incident report (IR) activities in the workflow of their existing security operations.
  • Nov 27th, 2018

    IR Tools Collection

    Log Analysis Tools

  • Lorgstars193 - Tool for advanced HTTPD logfile security analysis and forensics.
  • Logdissectstars97 - CLI utility and Python API for analyzing log files and other data.
  • Oct 3rd, 2018

    IR Tools Collection

    Adversary Emulation

  • Calderastars3k - Automated adversary emulation system that performs post-compromise adversarial behavior within Windows Enterprise networks. It generates plans during operation using a planning system and a pre-configured adversary model based on the Adversarial Tactics, Techniques & Common Knowledge (ATT&CK™) project.
  • APTSimulatorstars1.6k - Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised.
  • DumpsterFirestars813 - Modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations.
  • Mettastars902 - Information security preparedness tool to do adversarial simulation.
  • Network Flight Simulatorstars579 - Lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility.
  • RedHunt-OSstars1k - Virtual machine for adversary emulation and threat hunting.
  • Blue Team Training Toolkit (BT3) - Software for defensive security training, which will bring your network analysis training sessions, incident response drills and red team engagements to a new level.
  • IR Tools Collection

    All-In-One Tools

  • osquery - Easily ask questions about your Linux and macOS infrastructure using a SQL-like query language; the provided incident-response pack helps you detect and respond to breaches.
  • Redline - Provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis, and the development of a threat assessment profile.
  • Zentralstars566 - Combines osquery's powerful endpoint inventory features with a flexible notification and action framework. This enables one to identify and react to changes on OS X and Linux clients.
  • CimSweepstars585 - Suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
  • Doormanstars575 - osquery fleet manager that allows remote management of osquery configurations retrieved by nodes. It takes advantage of osquery's TLS configuration, logger, and distributed read/write endpoints, to give administrators visibility across a fleet of devices with minimal overhead and intrusiveness.
  • Falcon Orchestratorstars167 - Extendable Windows-based application that provides workflow automation, case management and security response functionality.
  • MozDefstars2.2k - Automates the security incident handling process and facilitate the real-time activities of incident handlers.
  • nightHawkstars583 - Application built for asynchronus forensic data presentation using ElasticSearch as the backend. It's designed to ingest Redline collections.
  • Open Computer Forensics Architecture - Another popular distributed open-source computer forensics framework. This framework was built on Linux platform and uses postgreSQL database for storing data.
  • The Sleuth Kit & Autopsy - Unix and Windows based tool which helps in forensic analysis of computers. It comes with various tools which helps in digital forensics. These tools help in analyzing disk images, performing in-depth analysis of file systems, and various other things.
  • TheHive - Scalable 3-in-1 open source and free solution designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly.
  • X-Ways Forensics - Forensics tool for Disk cloning and imaging. It can be used to find deleted files and disk analysis.
  • Belkasoft Evidence Center - The toolkit will quickly extract digital evidence from multiple sources by analyzing hard drives, drive images, memory dumps, iOS, Blackberry and Android backups, UFED, JTAG and chip-off dumps.
  • CIRTkitstars130 - CIRTKit is not just a collection of tools, but also a framework to aid in the ongoing unification of Incident Response and Forensics investigation processes.
  • Cyber Triage - Cyber Triage remotely collects and analyzes endpoint data to help determine if it is compromised. It’s agentless approach and focus on ease of use and automation allows companies to respond without major infrastructure changes and without a team of forensics experts. Its results are used to decide if the system should be erased or investigated further.
  • IR Tools Collection

    Evidence Collection

  • Cold Disk Quick Responsestars306 - Streamlined list of parsers to quickly analyze a forensic image file (dd, E01, .vmdk, etc) and output nine reports.
  • bulk_extractorstars552 - Computer forensics tool that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. Because of ignoring the file system structure, the program distinguishes itself in terms of speed and thoroughness.
  • ir-rescuestars345 - Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
  • IR Tools Collection

    OSX Evidence Collection

  • macOS Artifact Parsing Tool (mac_apt)stars411 - Plugin based forensics framework for quick mac triage that works on live machines, disk images or individual artifact files.
  • OSX Auditorstars3.1k - Free Mac OS X computer forensics tool.
  • OSX Collectorstars1.8k - OSX Auditor offshoot for live response.
  • IR Tools Collection

    Other Tools

  • Crits - Web-based tool which combines an analytic engine with a cyber threat database.
  • Diffystars577 - DFIR tool developed by Netflix's SIRT that allows an investigator to quickly scope a compromise across cloud instances (Linux instances on AWS, currently) during an incident and efficiently triaging those instances for followup actions by showing differences against a baseline.
  • sqhunterstars62 - Threat hunter based on osquery and Salt Open (SaltStack) that can issue ad-hoc or distributed queries without the need for osquery's tls plugin. sqhunter allows you to query open network sockets and check them against threat intelligence sources.
  • domfindstars18 - Python DNS crawler for finding identical domain names under different TLDs.
  • RaQet - Unconventional remote acquisition and triaging tool that allows triage a disk of a remote computer (client) that is restarted with a purposely built forensic operating system.
  • Stenographerstars1.7k - Packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. It stores as much history as it possible, managing disk usage, and deleting when disk limits are hit. It's ideal for capturing the traffic just before and during an incident, without the need explicit need to store all of the network traffic.
  • X-Ray 2.0 - Windows utility (poorly maintained or no longer maintained) to submit virus samples to AV vendors.
  • Fileintelstars102 - Pull intelligence per file hash.
  • HELKstars3k - Threat Hunting platform.
  • Hindsightstars658 - Internet history forensics for Google Chrome/Chromium.
  • Hostintelstars229 - Pull intelligence per host.
  • imagemounterstars85 - Command line utility and Python package to ease the (un)mounting of forensic disk images.
  • Stalk - Collect forensic data about MySQL when problems occur.
  • IR Tools Collection

    Timeline Tools

  • Timesketchstars1.7k - Open source tool for collaborative forensic timeline analysis.
  • Morguestars984 - PHP Web app by Etsy for managing postmortems.
  • Highlighter - Free Tool available from Fire/Mandiant that will depict log/text file that can highlight areas on the graphic, that corresponded to a key word or phrase. Good for time lining an infection and what was done post compromise.
  • Plasostars1.2k - a Python-based backend engine for the tool log2timeline.
  • IR Tools Collection

    Windows Evidence Collection

  • Fibratusstars1.4k - Tool for exploration and tracing of the Windows kernel.
  • AChoirstars153 - Framework/scripting tool to standardize and simplify the process of scripting live acquisition utilities for Windows.
  • Crowd Response - Lightweight Windows console application designed to aid in the gathering of system information for incident response and security engagements. It features numerous modules and output formats.
  • Panoramastars31 - Fast incident overview on live Windows systems.
  • PowerForensicsstars1.1k - Live disk forensics platform, using PowerShell.
  • PSReconstars427 - PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
  • IR Tools Collection

    Disk Image Creation Tools

  • AccessData FTK Imager - Forensics tool whose main purpose is to preview recoverable data from a disk of any kind. FTK Imager can also acquire live memory and paging file on 32bit and 64bit systems.
  • GetData Forensic Imager - Windows based program that will acquire, convert, or verify a forensic image in one of the following common forensic file formats.
  • Guymager - Free forensic imager for media acquisition on Linux.
  • IR Tools Collection

    Incident Management

  • CyberCPR - Community and commercial incident management tool with Need-to-Know built in to support GDPR compliance while handling sensitive incidents.
  • Fast Incident Response (FIR)stars1.3k - Cybersecurity incident management platform designed with agility and speed in mind. It allows for easy creation, tracking, and reporting of cybersecurity incidents and is useful for CSIRTs, CERTs and SOCs alike.
  • threat_notestars395 - Lightweight investigation notebook that allows security researchers the ability to register and retrieve indicators related to their research.
  • RTIR - Request Tracker for Incident Response (RTIR) is the premier open source incident handling system targeted for computer security teams. We worked with over a dozen CERT and CSIRT teams around the world to help you handle the ever-increasing volume of incident reports. RTIR builds on all the features of Request Tracker.
  • IR Tools Collection

    Linux Distributions

  • The Appliance for Digital Investigation and Analysis (ADIA) - VMware-based appliance used for digital investigation and acquisition and is built entirely from public domain software. Among the tools contained in ADIA are Autopsy, the Sleuth Kit, the Digital Forensics Framework, log2timeline, Xplico, and Wireshark. Most of the system maintenance uses Webmin. It is designed for small-to-medium sized digital investigations and acquisitions. The appliance runs under Linux, Windows, and Mac OS. Both i386 (32-bit) and x86_64 (64-bit) versions are available.
  • Computer Aided Investigative Environment (CAINE) - Contains numerous tools that help investigators during their analysis, including forensic evidence collection.
  • Digital Evidence & Forensics Toolkit (DEFT) - Linux distribution made for computer forensic evidence collection. It comes bundled with the Digital Advanced Response Toolkit (DART) for Windows. A light version of DEFT, called DEFT Zero, is also available, which is focused primarily on forensically sound evidence collection.
  • Security Onionstars2.9k - Special Linux distro aimed at network security monitoring featuring advanced analysis tools.
  • SANS Investigative Forensic Toolkit (SIFT) Workstation - Demonstrates that advanced incident response capabilities and deep dive digital forensic techniques to intrusions can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.
  • CCF-VMstars421 - CyLR CDQR Forensics Virtual Machine (CCF-VM): An all-in-one solution to parsing collected data, making it easily searchable with built-in common searches, enable searching of single and multiple hosts simultaneously.
  • NST - Network Security Toolkit - Linux distribution that includes a vast collection of best-of-breed open source network security applications useful to the network security professional.
  • IR Tools Collection

    Log Analysis Tools

  • StreamAlertstars2.6k - Serverless, real-time log data analysis framework, capable of ingesting custom data sources and triggering alerts using user-defined logic.
  • IR Tools Collection

    Memory Analysis Tools

  • LiMEstars1.2k - Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD.
  • Memoryze - Free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis.
  • Volatilitystars4.9k - Advanced memory forensics framework.
  • VolatilityBotstars235 - Automation tool for researchers cuts all the guesswork and manual tasks out of the binary extraction phase, or to help the investigator in the first steps of performing a memory analysis investigation.
  • Evolvestars243 - Web interface for the Volatility Memory Forensics Framework.
  • inVtero.netstars244 - Advanced memory analysis for Windows x64 with nested hypervisor support.
  • Responder PRO - Responder PRO is the industry standard physical memory and automated malware analysis solution.
  • VolDiffstars179 - Malware Memory Footprint Analysis based on Volatility.
  • IR Tools Collection

    Memory Imaging Tools

  • Belkasoft Live RAM Capturer - Tiny free forensic tool to reliably extract the entire content of the computer’s volatile memory – even if protected by an active anti-debugging or anti-dumping system.
  • Linux Memory Grabberstars226 - Script for dumping Linux memory and creating Volatility profiles.
  • Magnet RAM Capture - Free imaging tool designed to capture the physical memory of a suspect’s computer. Supports recent versions of Windows.
  • IR Tools Collection

    Other Lists

  • List of various Security APIsstars585 - Collective list of public JSON APIs for use in security.
  • IR Tools Collection

    Process Dump Tools

  • PMDump - Tool that lets you dump the memory contents of a process to a file without stopping the process.
  • IR Tools Collection

    Sandboxing/Reversing Tools

  • Cuckoo-modified-apistars16 - Python library to control a cuckoo-modified sandbox.
  • Mastiffstars149 - Static analysis framework that automates the process of extracting key characteristics from a number of different file formats.
  • Viperstars1.4k - Python based binary analysis and management framework, that works well with Cuckoo and YARA.
  • Virustotal - Free online service that analyzes files and URLs enabling the identification of viruses, worms, trojans and other kinds of malicious content detected by antivirus engines and website scanners.
  • Cuckoo-modifiedstars374 - Heavily modified Cuckoo fork developed by community.
  • Visualize_Logsstars129 - Open source visualization library and command line tools for logs (Cuckoo, Procmon, more to come).
  • IR Tools Collection

    Playbooks

  • IRMstars835 - Incident Response Methodologies by CERT Societe Generale.
  • IR Tools Collection

    Videos

  • The Future of Incident Response - Presented by Bruce Schneier at OWASP AppSecUSA 2015.
  • Oct 1st, 2018

    IR Tools Collection

    Log Analysis Tools

  • SysmonSearchstars328 - SysmonSearch makes Windows event log analysis more effective and less time consuming by aggregation of event logs.
  • Aug 22nd, 2018

    IR Tools Collection

    Other Tools

  • Scout2 - Security tool that lets Amazon Web Services administrators assess their environment's security posture.
  • IR Tools Collection

    Evidence Collection

  • Margarita Shotgunstars188 - Command line utility (that works with or without Amazon EC2 instances) to parallelize remote memory acquisition.
  • Jun 17th, 2018

    IR Tools Collection

    Windows Evidence Collection

  • IREC - All-in-one IR Evidence Collector which captures RAM Image, $MFT, EventLogs, WMI Scripts, Registry Hives, System Restore Points and much more. It is FREE, lightning fast and easy to use.
  • Mar 24th, 2018

    IR Tools Collection

    Adversary Emulation

  • AutoTTPstars219 - Automated Tactics Techniques & Procedures. Re-running complex sequences manually for regression tests, product evaluations, generate data for researchers.
  • Red Team Automation (RTA)stars849 - RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.
  • Nov 4th, 2017

    IR Tools Collection

    Disk Image Creation Tools

  • Bitscoutstars379 - Bitscout by Vitaly Kamluk helps you build your fully-trusted customizable LiveCD/LiveUSB image to be used for remote digital forensics (or perhaps any other task of your choice). It is meant to be transparent and monitorable by the owner of the system, forensically sound, customizable and compact.
  • May 20th, 2017

    IR Tools Collection

    Incident Management

  • Cyphon - Cyphon eliminates the headaches of incident management by streamlining a multitude of related tasks through a single platform. It receives, processes and triages events to provide an all-encompassing solution for your analytic workflow — aggregating data, bundling and prioritizing alerts, and empowering analysts to investigate and document incidents.
  • Feb 4th, 2017

    IR Tools Collection

    Other Tools

  • Cortex - Cortex allows you to analyze observables such as IP and email addresses, URLs, domain names, files or hashes one by one or in bulk mode using a Web interface. Analysts can also automate these operations using its REST API.
  • Jan 21st, 2017

    IR Tools Collection

    Playbooks

  • PagerDuty Incident Response Documentation - Documents that describe parts of the PagerDuty Incident Response process. It provides information not only on preparing for an incident, but also what to do during and after. Source is available on GitHubstars895.
  • Jul 12th, 2016

    IR Tools Collection

    Disk Image Creation Tools

  • Magnet ACQUIRE - ACQUIRE by Magnet Forensics allows various types of disk acquisitions to be performed on Windows, Linux, and OS X as well as mobile operating systems.
  • Last Checked At: 2021-10-25T04:26:10.259Z
    Previous
    paralax/awesome-honeypots
    Next
    jaredthecoder/awesome-vehicle-security

    About

    Track your favorite github awesome repo, not just star it. trackawesomelist.com provides website, newsletter, RSS for tracking the popular awesome list by daily and weekly.
    Contact us: [email protected]
    Track Awesome List - Track your favorite Github awesome repos, not just star them | Product Hunt

    Subscribe

    Subscribe to our weekly newsletter to receive the awesome updates! We never send spam and you can unsubscribe instantly with one click. Here's past issues.

    Links

    Follow us on TwitterSubscribe us on TelegramSubmit awesome list repoNewsletterDonateSitemap