PoorBillionaire

dockerfiles

Various Dockerfiles I use on the desktop and on servers.

volatility

An advanced memory forensics framework

flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.

suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

capa

The FLARE team's open-source tool to identify capabilities in executable files.

velociraptor

Digging Deeper....

sleuthkit

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

go-audit

go-audit is an alternative to the auditd daemon that ships with many distros

streamparse

Run Python in Apache Storm topologies. Pythonic API, CLI tooling, and a topology DSL.

speakeasy

Windows kernel and user mode emulation.

protocol

An ASCII Header Generator for Network Protocols

unfurl

Extract and Visualize Data from URLs using Unfurl

python-registry

Pure Python parser for Windows Registry hives.

lmg

Script for automating Linux memory capture and analysis

libewf

Libewf is a library to access the Expert Witness Compression Format (EWF)

Registry

Full featured, offline Registry parser in C#

c-aff4

An AFF4 C++ implementation.

nsrllookup

Checks with NSRL RDS servers looking for for hash matches

hotoloti

documentation, scripts, tools related to Zena Forensics (http://blog.digital-forensics.it)

nsrlsvr

libscca

Library and tools to access the Windows Prefetch File (SCCA) format.

python-rtkit

Python Api for Request Tracker's REST interface

taco-bell-as-a-service

For maximizing efficiency on those Taco Bell trips

macOS-triage

macOS triage is a python script to collect various macOS logs, artifacts, and other data.

CDPO

CDPO is a tool to validate, de-duplicate, combine, query, and encrypt track data recovered from a breach.

mcurses

A curses like library that 'draws' in memory instead of stdout

BupSummary

Gathers summary details from multiple McAfee antivirus quarantine (BUP) files