DFIRRegex

A curated list of tools for incident response

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Automation and Scaling of Digital Forensics Tools

Query and report user logons relations from MS Windows Security Events

Zombie Ant Farm: Primitives and Offensive Tooling for Linux EDR evasion.

A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update. Use these CSVs to create your own known good hash sets!

A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.

A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update.

A repository containing the research output from my GCFE Gold Paper which compared Windows 10 and Windows 11.

Proof-of-Concept to evade auditd by tampering via ptrace