dfir · GitHub Topics | GitHub 中文社区

my-arsenal-of-aws-security-tools

@toniblyx

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

翻译 - 用于AWS安全的开源工具列表：防御性，攻击性，审计，DFIR等。

cloud auditing incident-response aws-inventory iam dfir cloudtrail aws-infrastructure aws-lambda Security

Shell9.02 k

2 个月前

zeek

@zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

翻译 - Zeek是功能强大的网络分析框架，与您可能知道的典型IDS有很大不同。

bro network-monitoring pcap Security nsm dfir zeek

C++6.5 k

16 天前

DetectionLab

Chris Long@clong

Automate the creation of a lab environment complete with security tooling and logging best practices

翻译 - Vagrant＆Packer脚本可构建带有安全工具和记录最佳实践的完整实验室环境

Vagrant vagrantfile packer Cybersecurity lab-environment dfir Terraform Ansible PowerShell detection

HTML4.67 k

6 个月前

ThreatHunter-Playbook

@OTRF

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

翻译 - 威胁猎人的剧本，有助于发展狩猎活动的技术和假设。

threat-hunting sysmon hunting-campaigns hypothesis hunting dfir hunter mitre-attack-db mitre

Python4.05 k

10 个月前

awesome-forensics

@cugu

⭐️ A curated list of awesome forensic analysis tools and resources

computer-forensics digital-forensics forensic-analysis dfir Open Source free

4.03 k

15 天前

chainsaw

@WithSecureLabs

Rapidly Search and Hunt through Windows Forensic Artefacts

翻译 - 快速搜索和搜寻 Windows 事件日志

attack Rust Security threat-hunting blueteam chainsaw detection dfir forensics logs

Rust2.92 k

15 天前

LogonTracer

@JPCERTCC

Investigate malicious Windows logon by visualizing and analyzing Windows event log

翻译 - 通过可视化和分析Windows事件日志来调查恶意Windows登录

Security dfir JavaScript visualization active-directory event-log blueteam Python

Python2.76 k

6 个月前

hayabusa

@Yamato-Security

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

dfir threat hunting Windows event logs Rust sigma detection attack

Rust2.37 k

1 天前

EVTX-ATTACK-SAMPLES

@sbousseaden

Windows Events Attack Samples

翻译 - Windows 事件攻击示例

threat-hunting evtx windows-security mitre-attack detection-engineering dataset winlogbeat dfir

HTML2.26 k

2 年前

cyberchef-recipes

@mattnotmax

A list of cyber-chef recipes and curated links

翻译 - 网络厨师食谱和精选链接列表

cyberchef Malware dfir incident-response data-manipulation cyberchef-recipes Regular expression

1.98 k

6 个月前

MemLabs

@stuxnet999

Educational, CTF-styled labs for individuals interested in Memory Forensics

翻译 - CTF风格的教育性实验室，面向对记忆取证感兴趣的个人

forensics dfir memory-forensics Windows ctf ctf-challenges digital-forensics Security

Shell1.67 k

4 年前

Blue-Team-Notes

@Purp1eW0lf

You didn't think I'd go and leave the blue team out, right?

dfir PowerShell blueteam Cybersecurity

1.62 k

1 年前

Hunting-Queries-Detection-Rules

@Bert-JanP

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Azure defender-for-endpoint dfir kql sentinel threat-hunting vulnerability-management zero-day blueteam Cybersecurity

Python1.3 k

2 天前

WELA

@Yamato-Security

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

翻译 - WELA（Windows 事件日志分析器）：用于 Windows 事件日志的瑞士军刀！ゑ罗（ウェラ）

dfir log analysis forensics incident response sigma Windows event logs

PowerShell770

2 年前

DFIRArtifactMuseum

@AndrewRathbun

#安卓#The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts...

dfir artifacts-repository Windows Linux iOS Android macOS

HTML560

1 个月前

DFIRMindMaps

@AndrewRathbun

A repository of DFIR-related Mind Maps geared towards the visual learners!

翻译 - 面向视觉学习者的 DFIR 相关思维导图存储库！

kape eztools dfir mindmaps digitalforensics tcpdump rdp

515

2 年前

dfir-orc

@DFIR-ORC

Forensics artefact collection tool for systems running Microsoft Windows

翻译 - 适用于运行Microsoft Windows的系统的取证伪像收集工具

dfir incident-response collection

C++393

1 个月前

varc

@cado-security

Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident.

Amazon Web Services aws-fargate aws-lambda cloud-security dfir dfir-automation forensics memory-forensics aws-forensics docker-forensics

Python251

3 个月前

TheHitchhikersGuidetoDFIRExperiencesFromBeginnersandExperts

@Digital-Forensics-Discord-Server

The official repo for a project involving a crowdsourced DFIR book. The main purpose of this book is to give anyone interested an opportunity to write a chapter of a book to get their name out there, ...

book dfir Cybersecurity leanpub

Ruby182

8 个月前