AMIRA: Automated Malware Incident Response & Analysis AMIRA is a service for automatically running the analysis on the OSXCollector output files. The automated analysis is performed via OSXCollector Output Filters, in particular, The...
PcapXray A Network Forensics Tool – To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction. PcapXray Design Specification Goal: Given...
OSXCollector Manual OSXCollector is a forensic evidence collection & analysis toolkit for OSX. Forensic Collection The collection script runs on a potentially infected machine and outputs a JSON file that...
Termshark A terminal user-interface for tshark, inspired by Wireshark. If you’re debugging on a remote machine with a large pcap and no desire to scp it back to your desktop,...
Forensics / Information Gathering / Web Information Gathering
by do son · Published June 23, 2019 · Last modified November 20, 2022
POCKINT (a.k.a. Pocket Intelligence) is the OSINT swiss army knife for DFIR/OSINT professionals. Designed to be a lightweight and portable GUI program (to be carried within USBs or investigation VMs),...
Forensics / Malware Analysis / Networking
by do son · Published June 18, 2019 · Last modified February 21, 2021
histstat This is a cross-platform command-line tool for obtaining live, rudimentary network connection data on a computer system. This tool was designed for network and security analysts to easily view...
LogonTracer Investigate malicious logon by visualizing and analyzing Windows active directory event logs. LogonTracer uses PageRank and ChangeFinder to detect malicious hosts and accounts from the event log. This tool can visualize the following...
dfirtriage Digital forensic acquisition tool for Windows-based incident response. DFIRtriage is a tool intended to provide Incident Responders with rapid host data. Written in Python, the code has been compiled...
Get-EnhancedWinEvent A Powershell Cmdlet that gets events from event logs and event tracing log files on local and remote computers enhances them with details from their XML representation. The Get-EnhancedWinEvent...
pcapfex ‘Packet CAPture Forensic Evidence eXtractor’ is a tool that finds and extracts files from packet capture files. It was developed by Viktor Winkelmann as part of a bachelor thesis. The power of pcapfex lies in...
The ADTimeline script generates a timeline based on Active Directory replication metadata for objects considered of interest. Replication metadata gives you the time at which each replicated attribute for a...
AutoMacTC: Automated Mac Forensic Triage Collector This is a modular forensic triage collection framework designed to access various forensic artifacts on macOS, parse them, and present them in formats viable...
FLARE VM – a fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing, etc.. Installed Tools Android dex2jar apktool Debuggers flare-qdb scdbg OllyDbg + OllyDump + OllyDumpEx...
ATTACKdatamap A datasource assessment on an event level to show potential coverage of the “MITRE ATT&CK” framework. This tool is developed by me and has no affiliation with “MITRE” nor...
Zeek Network Security Monitor Zeek is a powerful framework for network analysis and security monitoring. It is a powerful system that on top of the functionality it provides out of...
Support Securityonline.info site. Thanks!
