scudette

velociraptor

Velociraptor hunts for evil...

awesome-incident-response

A curated list of tools for incident response

Audit

Collection of Audit and Compliance related VQL artifacts

http-logging-proxy

sandbox-attacksurface-analysis-tools

Set of tools to analyze Windows sandboxes for exposed attack surface.

WinPmem

The multi-platform memory acquisition tool.

aff4

The Advanced Forensic File Format. NOTE: This project has been split into C and Python projects and moved to https://github.com/aff4/pyaff4 and https://github.com/Velocidex/c-aff4

archiver

assert

A simple assertion library using Go generics

blackfriday

Blackfriday: a markdown processor for Go

DFIRArtifactMuseum

The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts that may no longer be readily available anymore.

eql

eqllib

etw

Go library for ETW (Event Tracing for Windows) events processing

etw-providers-docs

Document ETW providers

evtx

Golang Parser for Microsoft Event Logs

EVTX-ATTACK-SAMPLES

Windows Events Samples

Extensible-Storage-Engine

fb-util-for-appx

Create .appx files.

go-ese

Go implementation of an Extensible Storage Engine parser

go-libaudit

go-libaudit is a library for communicating with the Linux Audit Framework.

impacket

Impacket is a collection of Python classes for working with network protocols.

pywintrace

ETW Python Library

restic

Fast, secure, efficient backup program

RustyUsn

USN to JSON

sigma-go

A Go implementation and parser for Sigma rules.

tccprofile

Creates a TCC profile for new Privacy Payloads in macOS Mojave

ttlcache

An in-memory string-interface{} map with various expiration options for golang

velociraptor-docs

Documentation site for Velociraptor

winreg-kb

Windows Registry Knowledge Base