dfir.md

Link Collections

• https://github.com/meirwah/awesome-incident-response

Blogs

• New Microsoft Incident Response team guide shares best practices for security teams and leaders - Dec 2023

Incident Frameworks

• Incident Response Heirarch of Needs

Playbooks & IR Planning

• Syntax-IR Playbooks
• NIST Incident Response Plan: Building Your Own IR Process Based on NIST Guidelines
• How to Build an Incident Response Playbook

Well Known Vendor Teams

• MSFT Dart Blogs

Misc Repos

• https://github.com/teamdfir

Tools

Commercial

• https://www.intezer.com/

Linux Tools

Memmory

• https://github.com/Sysinternals/ProcDump-for-Linux
• https://github.com/microsoft/avml
• https://docs.microsoft.com/en-us/security/research/project-freta/
• https://github.com/504ensicsLabs

Windows Tools

• https://github.com/Countercept/chainsaw

Velociraptor

• https://github.com/Velocidex/velociraptor

Deployment

• https://github.com/weslambert/velociraptor-docker
• https://docs.velociraptor.app/docs/deployment/cloud/