hiddenillusion Goto Github PK

analyzepdf

Tool to help analyze PDF files

analyzepe

Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.

appcompatprocessor

"Evolving AppCompat/AmCache data analysis beyond grep"

auto_rem

Eliminating some repetitiveness during file analysis (in progress)

bmc-tools

RDP Bitmap Cache parser

cloud-forensics-utils

Python library to carry out DFIR analysis on the Cloud

community

Volatility plugins developed and maintained by the community

creddump7

cuckoo3.2

This repo contains patches for the 0.3.2 release of the cuckoo sandbox (http://www.cuckoobox.org)

es-stuff

some elastic search stuff

eventmonkey

A Windows Event Processing Utility

example-code

Some things I found useful along the way

filelookup

Quick & dirty script to get info on a file from online resources (VirusTotal, Team Cymru, Shadow Server etc.)

hiddenillusion.github.io

Repo for https://hiddenillusion.github.io

indxparse

Tool suite for inspecting NTFS artifacts.

ipinfo

Searches various online resources to try and get as much info about an IP/domain as possible.

ir

Some dfir stuff

knockknock

Who's there?

lfle

Recover event log entries from an image by heurisitically looking for record structures.

liblightgrep

not the worst forensics regexp engine

nomorexor

Tool to help guess a files 256 byte XOR key by using frequency analysis

process-forest

Reconstruct process trees from event logs

pylzma

Python bindings for the LZMA library

registrydecoder

This is a copy of the Registry Decoder repository from Google Code.

timesketch

Collaborative forensics timeline analysis

useful-scripts

volatility

An advanced memory forensics framework

volatility-autoruns

Autoruns plugin for the Volatility framework

volatility-foo

volatility-plugins