Dfir

Awesome Incident Response

A curated list of tools and resources for digital forensics and incident response (DFIR) teams.

Incident Response

A curated list of tools and resources for digital forensics and incident response (DFIR) teams.

Forensics

A curated list of awesome free (mostly open source) forensic analysis tools and resources for digital investigations.

Awesome Forensics

A curated list of awesome free forensic analysis tools, resources, and learning materials for digital investigators.

ThreatHunter-PlaybookPython

A community-driven open-source project that structures threat hunting workflows using MITRE ATT&CK, Jupyter notebooks, and AI-augmented planning.

LOKIPython

A simple IOC and YARA scanner for detecting malware and security threats via file names, hashes, YARA rules, and C2 connections.

ChainsawRust

A fast, standalone tool for rapid threat hunting and forensic analysis of Windows event logs and other forensic artefacts.

TimesketchPython

An open-source tool for collaborative forensic timeline analysis, enabling teams to organize, annotate, and investigate timelines together.

LogonTracerPython

A security tool that visualizes and analyzes Windows Active Directory event logs to investigate malicious logon activity.

Security Onion

A Linux distribution for threat hunting, enterprise security monitoring, and log management.

HayabusaRust

A Sigma-based threat hunting and fast forensics timeline generator for Windows event logs, written in Rust.

sysmon-modularPowerShell

A modular repository of Sysmon configuration modules for customizable endpoint detection and logging.

Windows Events Attack SamplesHTML

A collection of 200 Windows EVTX event log samples mapped to MITRE ATT&CK techniques for detection testing and threat hunting.

YETIPython

A forensics intelligence platform that bridges CTI and DFIR by storing threat intelligence and enabling bulk observable searches and threat-focused analysis.

APT Notes

A repository of publicly-available reports and blogs on APT (Advanced Persistent Threat) campaigns, activity, and software, organized by year.

KQL Advanced Hunting Queries & Analytics RulesPython

A collection of ready-to-use KQL queries for threat hunting, detection, and analytics in Microsoft Defender for Endpoint and Azure Sentinel.