DFIRJoe

analyzeMFT

fastfinder

Incident Response - Fast suspicious file finder

Sentinel-One-STAR-Rules-Threat-Hunts

SentinelOne STAR Rules

defender-detectionhistory-parser

A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.

WELA

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

OpenSearch-Dashboards

📊 Open source visualization dashboards for OpenSearch.

ripgrep

ripgrep recursively searches directories for a regex pattern while respecting your gitignore

XstReader

Xst Reader is an open source viewer for Microsoft Outlook’s .ost and .pst files, written entirely in C#. To download an executable of the current version, go to the releases tab.

gene

Signature engine for all your logs

Get-MiniTimeline

Get-MiniTimeline - Triage Collection and Timeline Generation w/ KAPE

velociraptor

Digging Deeper....

KapeFiles

This repository serves as a place for community created Targets and Modules for use with KAPE.

json2csv

Convert json to csv with column titles

Detection-Ideas-Rules

Detection Ideas & Rules repository.

Zircolite

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

DetectionLab

Automate the creation of a lab environment complete with security tooling and logging best practices

chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

velociraptor-to-timesketch

sof-elk

Configuration files for the SOF-ELK VM

sigma

Main Sigma Rule Repository

AllthingsTimesketch

This repository contains helper scripts and custom configs to get the best out of Google's Timesketch project.

timesketch

Collaborative forensic timeline analysis