Automate the creation of a lab environment complete with security tooling and logging best practices

Hybrid + Identity Cyber Range

Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.

A collection of Terraform and Ansible scripts that automatically (and quickly) deploys a small Velociraptor R&D lab.

ActiveMime File Format Documentation

Minion rules for DFIR work.

Cortex-Analyzers Modified - SecTeam/CERT/SOC Security orchestration tools on steroids

Manage loki scans over a large network.

This script is designed to pull data from the carbon black cloud. One disadvantage of the CBC GUI is the inability to see the command line for each process in bulk. Instead, you need to click on each process individually. This spits out the command line so you can quickly spot evil.

A Python, Boto3 script that leverages a forensic volume to attach & mount to a selected instance, run a memory dump, unmount and detach from the selected instance and finally attach & mount to a Forensic Workstation

splits a URL into individual components, unescapes arguments, and performs light calculations for manual or automated analysis

A collection of Terraform and Ansible scripts that automatically (and quickly) deploys a small HELK R&D lab in Azure.

GoFIR is a DFIR tool written in Golang that can pull artifacts from remote hosts and store them in a S3 bucket of your choosing. It also has the ability to search for IOCs and return the results.

Small Incident Response Powershell script that collects various data from the system.Good alternative to run on a system while waiting for an approved AV scan( or instead of a scan)

A Python, Boto3 script that shuts down a selected instance, detaches the instance, generates a snapshot volume and then attaches and mounts both volumes to a workstation

Search for given file hash

Confirm file type by matching the magic signature ("number").

DFIR Lab in AWS

Ingest and query NIST NSRL Reference Data Sets in Elasticsearch with Python tools and libraries.