This is a curated list of tools for this category.
- AMIRA - Automated Malware Incident Response & Analysis
- APT-Hunter - Threat Hunting Tool For Windows Event Logs Which Made By Purple Team Mindset To Provide Detect APT Movements Hidden In The Sea Of Windows Event Logs To Decrease The Time To Uncover Suspicious Activity
- Acheron - Indirect Syscalls For AV/EDR Evasion In Go Assembly
- Adama - Searches For Threat Hunting And Security Analytics
- Andriller - Software Utility With A Collection Of Forensic Tools For Smartphones
- Attack Monitor - Endpoint Detection And Malware Analysis Software
- AutoMacTC - Automated Mac Forensic Triage Collector
- Autotimeliner - Automagically Extract Forensic Timeline From Volatile Memory Dump
- AzureHunter - A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365
- Beagle - An Incident Response And Digital Forensics Tool Which Transforms Security Logs And Data Into Graphs
- CIRTKit - Tools For The Computer Incident Response Team
- CSIRT-Collect - PowerShell Script To Collect Memory And (Triage) Disk Forensics
- Columbo - A Computer Forensic Analysis Tool Used To Simplify And Identify Specific Patterns In Compromised Datasets
- Covert-Control - Google Drive, OneDrive And Youtube As Covert-Channels - Control Systems Remotely By Uploading Files To Google Drive, OneDrive, Youtube Or Telegram
- Cutter - Free And Open-Source GUI For Radare2 Reverse Engineering Framework
- DFIRTrack - The Incident Response Tracking Application
- DRAKVUF Sandbox - Automated Hypervisor-Level Malware Analysis System
- DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs
- Digital-Forensics-Lab - Free Hands-On Digital Forensics Labs For Students And Faculty
- Doldrums - A Flutter/Dart Reverse Engineering Tool
- Dumpulator - An Easy-To-Use Library For Emulating Memory Dumps. Useful For Malware Analysis (Config Extraction, Unpacking) And Dynamic Analysis In General (Sandboxing)
- EDRHunt - Scan Installed EDRs And AVs On Windows
- FACT - A Tool To Collect, Process And Visualise Forensic Data From Clusters Of Machines Running In The Cloud Or On-Premise
- FIR - Fast Incident Response
- FISSURE - Frequency Independent SDR-based Signal Understanding and Reverse Engineering
- FastFinder - Incident Response - Fast Suspicious File Finder
- Fennec - Artifact Collection Tool For *Nix Systems
- Freki - Malware Analysis Platform
- Gargamel - A Forensic Evidence Acquirer
- Ghidra - Software Reverse Engineering Framework
- Ghidra-Evm - Module For Reverse Engineering Smart Contracts
- Grafiki - Threat Hunting Tool About Sysmon And Graphs
- IDArling - Collaborative Reverse Engineering Plugin For IDA Pro & Hex-Rays
- IPED - Digital Forensic Tool - Process And Analyze Digital Evidence, Often Seized At Crime Scenes By Law Enforcement Or In A Corporate Investigation By Private Examiners
- IRTriage - Incident Response Triage - Windows Evidence Collection For Forensic Analysis
- Imago Forensics - Imago Is A Python Tool That Extract Digital Evidences From Images
- Inceptor - Template-Driven AV/EDR Evasion Framework
- Inhale - A Malware Analysis And Classification Tool
- Invoke-EDRChecker - Checks Running Processes, Process Metadata, Dlls Loaded Into Your Current Process And The Each DLLs Metadata, Common Install Directories, Installed Services, The Registry And Running Drivers For The Presence Of Known Defensive Products Such As AV's, EDR's And Logging Tools
- Kaiju - A Binary Analysis Framework Extension For The Ghidra Software Reverse Engineering Suite
- Killer - Is A Tool Created To Evade AVs And EDRs Or Security Tools
- LEAF - Linux Evidence Acquisition Framework
- LOLBITS v2.0.0 - C2 Framework That Uses Background Intelligent Transfer Service (BITS) As Communication Protocol And Direct Syscalls + Dinvoke For EDR User-Mode Hooking Evasion
- Laurel - Transform Linux Audit Logs For SIEM Usage
- LinuxCatScale - Incident Response Collection And Processing Scripts With Automated Reporting Scripts
- Live-Forensicator - Powershell Script To Aid Incidence Response And Live Forensics
- Lupo - Malware IOC Extractor. Debugging Module For Malware Analysis Automation
- MIG - Distributed And Real Time Digital Forensics At The Speed Of The Cloud
- Ma2Tl - macOS Forensic Timeline Generator Using The Analysis Result DBs Of Mac_Apt
- MalConfScan - Volatility Plugin For Extracts Configuration Data Of Known Malware
- Malboxes - Builds Malware Analysis Windows VMs So That You Don'T Have To
- Mandiant-Azure-AD-Investigator - PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity
- Mortar - Evasion Technique To Defeat And Divert Detection And Prevention Of Security Products (AV/EDR/XDR)
- MrKaplan - Tool Aimed To Help Red Teamers To Stay Hidden By Clearing Evidence Of Execution
- NTFSTool - Forensics Tool For NTFS (Parser, MTF, Bitlocker, Deleted Files)
- Norimaci - Simple And Lightweight Malware Analysis Sandbox For macOS
- OSFClone - Open Source Utility To Create And Clone Forensic Disk Images
- OSXCollector - A Forensic Evidence Collection & Analysis Toolkit For OS X
- OpenEDR - Open EDR Public Repository
- PMAT-labs - Labs For Practical Malware Analysis And Triage
- PowerShellArsenal - A PowerShell Module Dedicated To Reverse Engineering
- Pylirt - Python Linux Incident Response Toolkit
- Pyramid - A Tool To Help Operate In EDRs' Blind Spots
- Pywirt - Python Windows Incident Response Toolkit
- Qu1cksc0pe - All-in-One Static Malware Analysis Tool
- RESim - Reverse Engineering Software Using A Full System Simulator
- Radare2 - UNIX-like Reverse Engineering Framework And Command-Line Toolset
- RdpCacheStitcher - RdpCacheStitcher Is A Tool That Supports Forensic Analysts In Reconstructing Useful Images Out Of RDP Cache Bitmaps
- RedGuard - C2 Front Flow Control Tool, Can Avoid Blue Teams, AVs, EDRs Check
- RedHunt OS v2 - Virtual Machine For Adversary Emulation And Threat Hunting
- RedRabbit - Red Team PowerShell Script
- RefleXXion - A Utility Designed To Aid In Bypassing User-Mode Hooks Utilised By AV/EPP/EDR Etc
- Registry-Recon - Cobalt Strike Aggressor Script That Performs System/AV/EDR Recon
- S1EM - This Project Is A SIEM With SIRP And Threat Intel, All In One
- SIRAS - Security Incident Response Automated Simulations
- SLSA - Supply-chain Levels For Software Artifacts
- Sandbox_Scryer - Tool For Producing Threat Hunting And Intelligence Data From Public Sandbox Detonation Output
- Sentinel-Attack - Tools To Rapidly Deploy A Threat Hunting Capability On Azure Sentinel That Leverages Sysmon And MITRE ATT&CK
- SharpEDRChecker - Checks Running Processes, Process Metadata, DLLs Loaded Into Your Current Process And The Each DLLs Metadata, Common Inst all Directories, Installed Services And Each Service Binaries Metadata, Installed Drivers And Each Drivers Metadata, All For The Presence Of Known Defensive Products Such As AV's, EDR's And Logging Tools
- Sherloq - An Open-Source Digital Image Forensic Toolset
- Skrull - A Malware DRM, That Prevents Automatic Sample Submission By AV/EDR And Signature Scanning From Kernel
- Subparse - Modular Malware Analysis Artifact Collection And Correlation Framework
- SysWhispers - AV/EDR Evasion Via Direct System Calls
- SysWhispers2 - AV/EDR Evasion Via Direct System Calls
- SysWhispers3 - AV/EDR Evasion Via Direct System Calls
- ThreatHound - Tool That Help You On Your IR & Threat Hunting And CA
- Turbinia - Automation And Scaling Of Digital Forensics Tools
- TuxResponse - Linux Incident Response
- Tylium - Primary Data Pipelines For Intrusion Detection, Security Analytics And Threat Hunting
- UAC - Unix-like Artifacts Collector
- UEFI_RETool - A Tool For UEFI Firmware Reverse Engineering
- Usbrip - Simple Command Line Forensics Tool For Tracking USB Device Artifacts (History Of USB Events) On GNU/Linux
- VolExp - Volatility Explorer
- Volatility GUI - GUI For Volatility Forensics Tool
- Volatility Workbench - A GUI For Volatility Memory Forensics
- Watcher - Open Source Cybersecurity Threat Hunting Platform
- Whids - Open Source EDR For Windows
- auditpolCIS - CIS Benchmark Testing Of Windows SIEM Configuration
- efiXplorer - IDA Plugin For UEFI Firmware Analysis And Reverse Engineering Automation
- reFlutter - Flutter Reverse Engineering Framework