#dfir (30 Repositories)
Ranked open-source repositories tagged with #dfir, scored by pull request acceptance likelihood and maintainer engagement velocity.
54.7%
104.3h
30 repositories tagged #dfir
Yamato-Security/suzaku
Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.
Yamato-Security/hayabusa-rules
Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.
zeek/zeek
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
mandiant/macos-UnifiedLogs
A cross platform parser for Apple UnifiedLogs!
RyanDFIR/hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
Yamato-Security/hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
puffyCid/artemis
A cross platform forensic parser written in Rust!
BARGHEST-ngo/MESH
Wireless ADB, over the internet; not just local Wi-Fi. An encrypted, censorship-resistant mesh VPN making remote forensics and network monitoring seamless.
WithSecureOpenSource/chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
Lookyloo/lookyloo
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.
helixmap/sigwood
Local-first, transparent threat hunting for the logs you already have: Zeek, Pi-hole, syslog, CloudTrail. Named technique behind every finding. No SIEM, no agent, no black box.
r3nzsec/irflow-timeline
DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt, process inspection, lateral movement tracking, persistence detection, and VirusTotal enrichment.
AndrewRathbun/DFIRArtifactMuseum
The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts that may no longer be readily available anymore.
cgosec/Blauhaunt
A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts
pedramamini/ThreatIngestor
Extract and aggregate threat intelligence.
AppliedIR/Valhuntir
Valhuntir CLI — AI-augmented incident response platform
MISP/misp-warninglists
Warning lists to inform users of MISP about potential false-positives or other information in indicators
sroberts/awesome-iocs
Curated sources of indicators of compromise, detection signatures and IOC tools.
Neo23x0/Loki-RS
🐍 High-performance, multi-threaded YARA & IOC scanner
LETHAL-FORENSICS/MemProcFS-Analyzer
MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
A3sal0n/CyberThreatHunting
A collection of resources for Threat Hunters
BSI-Bund/RdpCacheStitcher
RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.
JLospinoso/gargoyle
Historical Windows temporal memory-state research artifact for studying time-bound memory observations, validation limits, and defensive visibility.
google/turbinia
Automation and Scaling of Digital Forensics Tools
meirwah/awesome-incident-response
A curated list of tools for incident response
cugu/awesome-forensics
⭐️ A curated list of awesome forensic analysis tools and resources
toniblyx/my-arsenal-of-aws-security-tools
List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
Bert-JanP/Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
OTRF/ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
olafhartong/ATTACKdatamap
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework