DfirJos

CnC-detection

Detecting PowerShell Empire, Metasploit Meterpreter and Cobalt Strike agents by payload size sequence analysis and host correlation

DNS-tracer

Tracing the source of internal DNS requests with Microsoft Event Trace Log (ETL) files

sjosz-KAPE_mft

Logstash config that uploads CSV file containing parsed MFT with MFTEcmd

aws-tools-for-powershell

The AWS Tools for PowerShell lets developers and administrators manage their AWS services from the PowerShell scripting environment.

CVE-2019-19781

DFIR notes for Citrix ADC (NetScaler) appliances vulnerable to CVE-2019-19781

CyberThreatHunting

A collection of resources for Threat Hunters

import-configurations

Import configurations for Firefly III

joy

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

KapeFiles

This repository serves as a place for community created Targets and Modules for use with KAPE.

Parse-and-Enrich

malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide

openssh-portable

Portable OpenSSH, all Win32-OpenSSH releases and wiki are managed at https://github.com/powershell/Win32-OpenSSH

RECmd

Command line access to the Registry

RegistryPlugins

sysmon-config

Sysmon configuration file template with default high-quality event tracing

velociraptor

Digging Deeper....

velociraptor-docs

Documentation site for Velociraptor