VanillaWindowsReference

A curated list of tools for incident response

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Automation and Scaling of Digital Forensics Tools

A web front-end for password cracking and analytics

Query and report user logons relations from MS Windows Security Events

Zombie Ant Farm: Primitives and Offensive Tooling for Linux EDR evasion.

A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.

A repo to centralize some of the regular expressions I've found useful over the course of my DFIR career.

A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update.

A repository containing the research output from my GCFE Gold Paper which compared Windows 10 and Windows 11.