What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows …
Bashfuscator – A Fully Configurable And Extendable Bash Obfuscation Framework
Documentation What is Bashfuscator? Bashfuscator is a modular and extendable Bash obfuscation framework written in Python 3. It provides numerous …
Mimicry – Security Tool For Active Deception In Exploitation And Post-Exploitation
Mimicry is a security tool developed by Chaitin Technology for active deception in exploitation and post-exploitation. Active deception can live …
PersistenceSniper – Powershell Script That Can Be Used By Blue Teams, Incident Responders And System Administrators To Hunt Persistences Implanted In Windows Machines
PersistenceSniper is a Powershell script that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences …
Live-Forensicator – Powershell Script To Aid Incidence Response And Live Forensics
Live Forensicator is part of the Black Widow Toolbox, its aim is to assist Forensic Investigators and Incidence responders in …
LinuxCatScale – Incident Response Collection And Processing Scripts With Automated Reporting Scripts
Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based …
CSIRT-Collect – PowerShell Script To Collect Memory And (Triage) Disk Forensics
A PowerShell script to collect memory and (triage) disk forensics for incident response investigations. The script leverages a network share, …
Mediator – An Extensible, End-To-End Encrypted Reverse Shell With A Novel Approach To Its Architecture
Mediator is an end-to-end encrypted reverse shell in which the operator and the shell connect to a “mediator” server that …
WinPmem – The Multi-Platform Memory Acquisition Tool
The WinPmem memory acquisition driver and userspace WinPmem has been the default open source memory acquisition driver for windows for …
Tscopy – Tool to parse the NTFS $MFT file to locate and copy specific files
Introducing TScopy It is a requirement during an Incident Response (IR) engagement to have the ability to analyze files on …