Tools

Nestori Syynimaa's PowerShell toolkit for administering, auditing and (ab)using Azure AD/Entra ID and Office 365 — used defensively to check tenant configuration and hybrid-identity exposure.

Community-reported IP abuse database — checks whether an address has been reported for brute-forcing, spam or scanning, with a confidence score and report history.

The Android counterpart to iLEAPP — parses an Android filesystem or physical extraction into categorised, human-readable reports covering messaging, browser, app and system artifacts.

python3 aleapp.py -t fs -i extraction/ -o report/

Open Threat Exchange — a free, community-driven threat-intelligence sharing platform with searchable "pulses" of IOCs contributed by security researchers.

Eric Zimmerman's parser for Amcache.hve — a registry hive tracking executed and installed applications, including SHA1 hashes and first-execution timestamps.

AmcacheParser.exe -f Amcache.hve --csv out

Cross-platform Python NTFS $MFT parser — a free, scriptable alternative to MFTECmd for extracting file record metadata from a raw MFT extract.

analyzeMFT.py -f \$MFT -o mft.csv

An interactive online malware sandbox — unlike a fully automated sandbox, an analyst can click through the running VM in real time (dismiss a dialog, wait out a sleep timer) to get past evasion that defeats hands-off detonation.

Eric Zimmerman's parser for the Shimcache (AppCompatCache) registry value — a list of executables the OS has seen, one more source of program-execution evidence.

AppCompatCacheParser.exe -f SYSTEM --csv out

The Audit Record Generation and Utilization System — a network flow monitor that turns raw traffic into detailed, auditable flow records, one of the longest-running open network-audit projects still maintained.

argus -i eth0 -w flows.argus

Full-packet-capture indexing and search system (formerly Moloch) — captures and stores traffic at scale, then lets analysts search and pull sessions back out by any field, PCAP included.

Large-scale, indexed full-packet capture — captures and stores traffic while indexing session metadata for search, so a SOC can pull the exact PCAP for an alert from months of retained traffic instead of scrolling Wireshark.

Mounts forensic disk images (E01, dd, VHD and more) as native Windows disks, read-only and write-cached, so any Windows tool can browse or run analysis against them without a physical write-blocker.

Red Canary's library of small, individually-executable tests mapped one-to-one to ATT&CK techniques — run a single atomic test and check whether the expected alert fired, instead of a full adversary-emulation exercise.

Invoke-AtomicTest T1003.001

The graphical front-end to The Sleuth Kit — a complete open-source digital forensics platform for disk images: timeline analysis, keyword search, file recovery and more.

Sysinternals tool enumerating every autostart location on Windows (run keys, services, scheduled tasks, WMI, browser helper objects…) — the fastest way to spot a persistence mechanism.

autorunsc.exe -accepteula -a * -c -h -s > autoruns.csv

Microsoft's Acquire Volatile Memory for Linux — a self-contained, dependency-free memory acquisition tool designed to work across kernels without a matching LiME module.

./avml output.lime

Diffing enabled units against a known-good baseline is a fast way to spot a persistence unit an attacker added, without waiting for full artifact collection.

systemctl list-unit-files --state=enabled | sort > current_units.txt
diff baseline_units.txt current_units.txt

Free lightweight Windows memory acquisition tool from Belkasoft — designed to run cleanly even against systems with anti-debugging/anti-dumping protections.

CLI toolkit of chainable "units" (like a Unix pipeline) for deobfuscating and unpacking malware — base64/XOR decode, carve, decompress and extract config data in one piped command.

emit sample.bin | carve -f b64 | b64 | xor 0x41 | peek

Desktop app for searching and analysing large pcap/Zeek log sets with the Zed query language — much faster iteration than opening a huge capture in a GUI packet viewer.

Scans a disk image, memory dump or arbitrary blob for recognisable features (email addresses, credit-card numbers, URLs, EXIF data) using carving and regex, ignoring filesystem structure entirely — useful when the filesystem is damaged or unknown.

bulk_extractor -o output/ disk.dd

Thinkst's free trip-wire generator — produces tokens (a fake AWS key, a Word doc, a URL, a DNS name) that silently phone home the moment someone opens or uses them, turning "did anyone touch this?" into an instant alert.

Identifies capabilities in an executable — "reads the clipboard", "installs a service", "encrypts files" — by matching disassembly and API-call patterns, so an analyst gets a functional summary before doing manual reverse engineering.

capa malware.exe

An automated malware analysis sandbox descended from Cuckoo, focused on Configuration And Payload Extraction — it unpacks and extracts C2 configs from common malware families rather than just logging behaviour.

Config And Payload Extraction — a Cuckoo fork focused on automatically unpacking malware and dumping the decrypted C2 configuration of hundreds of known families.

Explores malicious HTTP traffic captured in a pcap — replays the conversation, reconstructs redirect chains and lets you pull out the delivered payload for analysis.

python captipper.py malicious.pcap

Lyft-originated tool that consolidates infrastructure and cloud asset relationships (AWS, GCP, GitHub, Okta, etc.) into a Neo4j graph for attack-surface and blast-radius analysis.

cartography --neo4j-uri bolt://localhost:7687

Cyber Defense Institute's free Windows artifact collector — grabs registry hives, event logs, prefetch, browser history and more into one archive for offline analysis.

Commercial mobile device forensics platform (UFED and related products) — the industry-standard hardware/software for extracting and decoding data from seized mobile devices.

PE editor and viewer for manually inspecting and patching Windows executable headers, sections, imports and resources — a staple of PE-format malware triage.

Fast command-line triage of Windows Event Logs — runs Sigma rules and built-in detection logic across EVTX files to surface logons, lateral movement and other indicators without loading them into a SIEM first.

chainsaw hunt evtx_dir/ -s sigma_rules/ --mapping mappings/sigma-event-logs-all.yml

/etc/ld.so.preload is loaded into every dynamically linked binary on the system, a favourite location for rootkit persistence.

cat /etc/ld.so.preload 2>/dev/null
ls -la /etc/ld.so.preload

The immutable attribute is sometimes set on a tampered binary or config to stop even root from silently editing it back.

lsattr -R /etc /bin /usr/bin 2>/dev/null | grep -- '----i'

A one-line sanity check that should always return nothing — if it returns something, that box has a serious permissions bug worth reporting.

ls -la /etc/shadow /etc/gshadow 2>/dev/null

spctl reports exactly why Gatekeeper would allow or block an app, signed, notarized, or neither, before deciding whether to trust it.

spctl -a -vv /Applications/Suspicious.app

A fast first pass on an IR call — who has logged in recently, who is on the box right now, and whether wtmp shows anything that does not line up with what the customer told you.

last -F -x | head -30
w
lastb -F | head -20   # failed logins, if btmp is enabled

Blue-team sweep of the classic autorun keys that survive reboot, the first place most simple malware persists.

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"

A malicious line appended to .zshrc or .bash_profile re-executes on every new terminal session, a common and easily missed persistence spot.

cat ~/.zshrc ~/.zprofile ~/.bash_profile ~/.bashrc 2>/dev/null

SIP being disabled removes a large set of macOS built-in tamper protections, and legitimate reasons to disable it outside development are rare.

csrutil status

Confirms whether the built-in packet filter is even enabled before drawing any conclusion from an absence of blocked-connection logs.

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

cron still works on macOS even though launchd is preferred, and it is checked less often, exactly why it is occasionally used for persistence.

crontab -l

The com.apple.quarantine extended attribute is what triggers the "are you sure you want to open this" prompt, worth checking in any investigation.

xattr -l ~/Downloads/suspicious.dmg

Reads macOS's TCC (Transparency, Consent and Control) database to show which apps were granted access to sensitive data — a common forensic/incident-response first step.

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "select client,auth_value,service from access;"

An exclusion path readable by a low-privileged user shows exactly where to drop a payload Defender will never scan.

Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

Bridgecrew/Palo Alto's static analysis scanner for infrastructure-as-code — flags insecure defaults in Terraform, CloudFormation, Kubernetes manifests, ARM and Dockerfiles before they're deployed.

checkov -d ./terraform

Open-source static vulnerability analysis for container images — the scanner behind Quay.io, indexes image layers and matches against multiple CVE feeds.

Capital One's rules engine for cloud governance — YAML policies describe the compliant state you want, and it can report, alert or automatically remediate drift across AWS/Azure/GCP.

custodian run -s output/ policy.yml

Microsoft's serverless tool for running attack simulation scenarios in Azure — executes ATT&CK-mapped techniques to validate that detections and alerts fire as expected.

Bishop Fox's situational-awareness tool for AWS, Azure and GCP — quickly maps what an account/role can do and where sensitive resources sit, used by both attackers and defenders auditing exposure.

cloudfox aws all-checks

Web-based pcap analysis and sharing platform — upload a capture, get a shareable link with a full protocol decode, annotations and export, for collaborating on a capture without emailing it around.

Identifies violations of least privilege in AWS IAM policies (e.g. privilege escalation, resource exposure, data exfiltration paths) and produces a browsable risk report.

cloudsplaining download\ncloudsplaining scan --input-file default.json

Cloud configuration scanner (now part of Aqua) for AWS/Azure/GCP/OCI — detects common misconfigurations across dozens of services with a plugin-based check engine.

Quick manual triage step before uploading a sample anywhere — hash it locally and grep against a downloaded IOC list (e.g. exported from MISP/ThreatFox) offline.

sha256sum suspicious.bin | tee /dev/stderr | cut -d' ' -f1 | grep -Ff known_bad_hashes.txt && echo MATCH

ICS/SCADA honeypot emulating industrial protocols (Modbus, S7comm, etc.) and PLC device fingerprints, to detect and study attacks against industrial control systems.

conpot -t default

TheHive project's observable-analysis engine — runs analyzers (VirusTotal, abuse.ch, MISP, sandbox lookups, etc.) against IOCs on demand or from a case.

A medium-interaction SSH and Telnet honeypot — logs brute-force attempts and full attacker shell sessions, and can fake a filesystem convincingly enough to capture what a bot or human does after it "gets in".

The first thing to run on any box during triage — what is listening, and what process owns it. Works the same shape on Linux and Windows.

# Linux
ss -ltnp
# Windows (PowerShell)
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess

A crowdsourced, behaviour-based intrusion detection and prevention engine — parses local logs for attack patterns and shares/consumes IP reputation with a global community, so one deployment benefits from every other one.

cscli decisions add --ip 1.2.3.4 --duration 24h --reason "manual ban"

The original open-source automated malware analysis sandbox — detonates a sample in an instrumented VM and reports API calls, network traffic, dropped files and screenshots.

cuckoo submit suspicious.exe

Live-response collector that grabs a fixed set of forensic artifacts (MFT, registry, event logs, prefetch…) from a running Windows system into a single zip, without needing to shut it down.

CyLR.exe -od C:\evidence

The DoD Cyber Crime Center's forensic fork of GNU dd — adds on-the-fly hashing, progress reporting, split output and error logging that a plain dd lacks, for making verifiable evidentiary disk images.

dc3dd if=/dev/sdb hash=sha256 log=image.log of=image.dd

Another forensics-focused dd variant (originally DoD Computer Forensics Lab) — hashing, status output and multiple simultaneous output files during acquisition.

dcfldd if=/dev/sdb of=image.dd hash=sha256 hashlog=image.sha256

Data recovery tool built to image failing drives — reads good sectors first and retries bad ones intelligently, maximising recovered data from a dying disk.

ddrescue -f -n /dev/sdb image.dd image.log

A SANS PowerShell module that hunts Windows Event Logs for signs of attack — obfuscated PowerShell, suspicious account use, service creation — the kind of manual EVTX review a threat hunter would otherwise do by hand.

.\DeepBlue.ps1 -log security

Event ID 5007 fires whenever Defender configuration changes, the fastest way to notice someone quietly whitelisting their own tooling.

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=5007}

-enc / -EncodedCommand is one of the most common obfuscation techniques seen in both commodity malware and offensive tooling.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object { $_.Message -match '-enc(odedcommand)?\s' }

Sysmon Event ID 10 with a GrantedAccess mask like 0x1010 or 0x1438 against lsass.exe is the standard signature of a credential-dumping attempt.

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=10} | Where-Object { $_.Message -match 'lsass.exe' }

Security Event 4656 against HKLM\SAM is a strong indicator of an offline credential-dumping attempt via reg save.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656} | Where-Object { $_.Message -match 'SAM' }

schtasks /create is a common way both attackers and legitimate admin tooling establish persistence; logging the event catches both.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698}

A Vagrant/Packer-built lab that stands up a small Windows Active Directory environment pre-wired with Splunk, Sysmon and Windows Event Forwarding — a ready-made range for practicing detection engineering and threat hunting.

Rabobank's toolset for scoring data source visibility, detection coverage and threat-actor relevance against the MITRE ATT&CK matrix, to prioritise where to build detections next.

ANSSI's forensic artifact collection tool for Windows — configurable, digitally-signed collectors gather volatile and on-disk evidence at scale across an enterprise.

A honeypot built to be exploited — emulates vulnerable network services (SMB, HTTP, FTP, MSSQL and more) specifically to capture the malware payloads that automated worms and bots drop when they try to exploit it.

Fox-IT's forensic framework for parsing disk images and filesystem artifacts at scale without mounting them — a Python toolkit built for automating triage across hundreds of acquisitions rather than one investigator, one image.

target-query disk.vmdk -f mft --csv

Community-maintained continuation of dnSpy — a .NET assembly editor, debugger and decompiler, the standard tool for analysing .NET malware and unpacking .NET loaders.

Visualises and diagnoses a domain's DNS and DNSSEC delegation chain — spots misconfigurations that would otherwise show up only as intermittent, hard-to-explain resolution failures.

Checks a Docker host and its running containers against the CIS Docker Benchmark — a fast, scripted way to see how far a host configuration is from the recommended baseline.

docker run --rm --net host --pid host --cap-add audit_control -v /var/lib:/var/lib:ro -v /var/run/docker.sock:/var/run/docker.sock:ro docker/docker-bench-security

Agentless dynamic malware analysis system built on Xen VMI — observes a sample from outside the guest, so it leaves no in-guest artifacts for anti-analysis code to detect.

Finds forgotten or stale IAM access keys across an AWS account — a common cloud hygiene gap and a fast win during a cloud security review.

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d

Quick manual persistence check across the four most commonly abused Run/RunOnce keys, without needing Autoruns installed on the box.

reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"

An unfamiliar or unsigned module in the list is one of the more reliable signs of a kernel-level rootkit.

lsmod | sort

The SIEM and endpoint-security layer built on the Elastic Stack — detection rules, timeline investigation and case management on top of whatever logs and Elastic Agent/Beats data are already being shipped.

NetFlow/sFlow/IPFIX analytics built on the Elastic Stack — ships flow data into Elasticsearch with ready-made dashboards for network traffic visibility.

Commercial mobile forensics tool for acquiring iOS/iCloud and some Android/BlackBerry backups and keychains — widely used in lawful mobile device examinations.

Get-ScheduledTask surfaces the same data as schtasks /query but is easier to filter and pipe into further checks.

Get-ScheduledTask | Where-Object { $_.State -ne 'Disabled' } | Select-Object TaskName, TaskPath, State

LaunchDaemons run as root at boot regardless of login, so an unfamiliar one here is a higher-severity find than a user LaunchAgent.

ls -la /Library/LaunchDaemons
plutil -p /Library/LaunchDaemons/*.plist

Per-user LaunchAgents run at login without needing root, making them the most common macOS persistence location for malware and legitimate tools alike.

ls -la ~/Library/LaunchAgents
plutil -p ~/Library/LaunchAgents/*.plist

A suite of free, individually-focused Windows forensic parsers — Registry Explorer, MFTECmd, EvtxECmd, PECmd (prefetch), Timeline Explorer and more — that between them cover most Windows artifact types KAPE collects.

MFTECmd.exe -f "$MFT" --csv out\

Eric Zimmerman's EVTX parser — turns Windows Event Logs into CSV/JSON/timeline output with maps for common event IDs, much faster than the native Event Viewer for bulk triage.

EvtxECmd.exe -f Security.evtx --csv out --csvf security.csv

Lightweight PE packer/compiler signature scanner with built-in unpacker scripts for common packers — a quick first pass before deeper static analysis.

Runs an XPath query straight against an exported .evtx file with the built-in wevtutil, no PowerShell EVTX cmdlets or third-party parser required.

wevtutil qe Security.evtx /lf:true /q:"*[System[(EventID=4688)]]" /f:text > logons.txt

Pulls every IPv4 address and FQDN-looking string out of an arbitrary text blob (a vendor report, a phishing email, a log dump) for quick pivoting into a threat-intel lookup.

grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' report.txt | sort -u
grep -oE '\b[a-z0-9.-]+\.[a-z]{2,}\b' report.txt | sort -u

The long-standing log-watching intrusion prevention daemon — matches patterns like repeated failed SSH logins in a log file and reacts by firewalling the offending IP, no agent or cloud dependency required.

fail2ban-client status sshd

Mandiant's next-gen network simulation tool for dynamic malware analysis — intercepts and fakes DNS/HTTP/HTTPS/SSL traffic on the analysis host itself, no separate VM needed.

fakenet.exe

A CNCF runtime security tool for containers and Kubernetes — watches kernel syscalls against a rule set to detect unexpected process execution, privilege escalation and file access inside running workloads.

Lightweight standalone Windows live-response collector — pulls processes, network connections, services, scheduled tasks and registry artifacts into a single CSV bundle.

A dependency-free bash IOC scanner in the same family as Loki — checks hashes, filenames, string matches and suspicious permissions against a simple indicator list, for hosts where nothing heavier can be installed.

./fenrir.sh /path/to/scan

abuse.ch's tracker for Emotet/Dridex/QakBot/TrickBot-family botnet C2 servers — publishes a live blocklist of active C2 IPs.

A Windows kernel-level observability and detection tool — captures and filters the raw kernel event stream (process, file, registry, network) with its own filtering expression language, built for host-based threat hunting.

fibratus run kevt.name = 'CreateProcess'

On a box recently compromised or patched, files touched in the last hour are the fastest lead into what actually changed.

find / -xdev -mmin -60 -type f 2>/dev/null | grep -v -E '^/(proc|sys)'

Surfaces 4732/4728 (member added to a security-enabled local/global group) events — the classic signal for privilege escalation via group membership abuse.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732,4728} |
  Select-Object TimeCreated, Id, @{n='Member';e={$_.Properties[0].Value}}, @{n='Group';e={$_.Properties[2].Value}}

Cross-references bucket ACLs and policies for public access — the single most common AWS misconfiguration behind accidental data exposure.

aws s3api list-buckets --query 'Buckets[].Name' --output text | \
tr '\t' '\n' | while read b; do
  aws s3api get-bucket-policy-status --bucket "$b" --query 'PolicyStatus.IsPublic' --output text 2>/dev/null | grep -q true && echo "PUBLIC: $b"
done

A plist edited outside a software update window is a strong signal of manual persistence tampering.

find /Library /System/Library ~/Library -name '*.plist' -mtime -7 2>/dev/null

Attacker-planted SUID binaries are a common Linux persistence/privesc trick; this lists every SUID/SGID file so you can eyeball it against a known-good baseline.

find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -exec ls -la {} \; 2>/dev/null

Mandiant's Windows counterpart to REMnux — a scripted install of a full reverse-engineering and malware-analysis toolchain onto a fresh Windows VM, for analysing Windows malware in its native environment.

An open-source management layer for osquery — schedules queries, manages the agent fleet and turns raw osquery output into a usable device-inventory and detection tool at organisation scale.

FireEye Labs Obfuscated String Solver — automatically extracts stack strings, decoded strings and tight-loop-obfuscated strings that plain `strings` misses in packed/obfuscated malware.

floss malware.exe -o strings.txt

Mandiant's successor to plain `strings` for malware triage — statically emulates a binary just enough to decode stack strings, obfuscated strings and strings built at runtime that a normal string dump never reveals.

floss malware.exe

Exterro's free disk-imaging and preview tool — creates forensically sound images (E01/dd), previews a live system's files and memory, and generates hashes for chain-of-custody, without needing the full FTK suite.

NCC Group's Google Cloud Platform security auditing tool — pulls IAM, network and resource configuration and highlights common GCP misconfigurations.

The Honeynet Project's generic low-interaction honeypot proxy — sits in front of any TCP port, logs every connection and can hand off to protocol-specific honeypots behind it, useful as a catch-all sensor across a whole address range.

Real-time terminal and browser web log analyzer — parses Apache/Nginx access logs on the fly for traffic, status codes and suspicious request patterns during an incident.

goaccess access.log -o report.html --log-format=COMBINED

NSA-released passive network mapping tool for ICS/SCADA environments — builds a topology map from captured traffic without sending any packets onto often-fragile OT networks.

A centralised log management platform built on Elasticsearch/OpenSearch and MongoDB — search, dashboards and alerting across every log source pointed at it, a common lighter-weight alternative to a full Elastic SIEM build.

Counts failed SSH password attempts per source IP from the system auth log — the fastest confirmation of a brute-force before reaching for fail2ban logs or a SIEM.

grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -20

Pulls every failed password attempt out of auth.log and ranks by source, the starting point for spotting a brute-force campaign.

grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn

Pull failed-logon events straight from the command line for a quick brute-force check, without opening Event Viewer.

wevtutil qe Security /q:"*[System[(EventID=4625)]]" /f:text /c:20

Tracks internet-wide scanning and background noise so a defender can tell "this IP is mass-scanning the whole internet" apart from "this IP is targeting us specifically" — cuts a huge amount of false-positive triage out of alert review.

Google's remote live-forensics framework — agents on endpoints answer forensic queries (files, processes, registry, memory) at scale for incident responders who cannot ship a disk image for every host.

Anchore's vulnerability scanner for container images and filesystems — pairs with Syft's SBOMs to give a fast, accurate CVE match against installed packages.

grype myapp:latest

Fast, free forensic disk imaging GUI for Linux — multi-threaded compression, EWF/E01/raw output and on-the-fly hash verification during acquisition.

Generates a SHA-256 hash list of an entire directory tree in one pass — feed the output into a threat-intel lookup or diff it against a known-good baseline.

find . -type f -exec sha256sum {} \; > hashes.txt

A Rust-based Windows Event Log fast-forensics timeline generator, built by Yamato Security — evaluates Sigma-compatible rules across EVTX files and outputs a scored, sortable timeline for triage.

hayabusa csv-timeline -d evtx_dir/ -o timeline.csv

Roberto Rodriguez's advanced hunting platform on the Elastic Stack — adds Spark/Jupyter analytics and graph capability on top of ELK for large-scale hypothesis-driven threat hunting.

Parses a Chrome/Chromium profile's history, cache, cookies, downloads and autofill into a single timeline and generates a Chrome-viewable HTML report — browser forensics without hand-decoding SQLite and LevelDB by hand.

python3 hindsight.py -i "Default" -o report

Runs PE-sieve across every running process on a system in one pass, flagging and dumping any that show signs of process hollowing or code injection — a whole-host sweep rather than a single-process check.

hollows_hunter64.exe

Classic low-interaction honeypot framework that can simulate thousands of virtual hosts with different OS fingerprints on a single machine, to soak up and log network scans.

honeyd -f honeyd.conf

Extensible, event-driven honeypot framework — dynamically spins up service listeners in response to observed connection attempts, geared toward capturing novel attack traffic.

Pulls Sysmon Event ID 3 (network connection) entries for a given process image — useful for confirming whether a suspicious binary actually phoned home.

Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' |
  Where-Object { $_.Id -eq 3 -and $_.Message -match 'powershell.exe' } |
  Select-Object TimeCreated, Message

Greps Sysmon Event ID 1 (process creation) for a suspicious substring in the command line — quick manual hunting when you do not yet have a Sigma rule for it.

Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' |
  Where-Object { $_.Id -eq 1 -and $_.Message -match 'EncodedCommand' } |
  Select-Object TimeCreated, Message

WMI event subscriptions (filter, consumer, binding) are a fileless persistence mechanism that a quick disk sweep will miss entirely.

Get-WmiObject -Namespace root\subscription -Class __EventFilter
Get-WmiObject -Namespace root\subscription -Class __EventConsumer
Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding

CrowdStrike's free public malware sandbox (Falcon Sandbox front end) — submit a sample or hash and get a detailed static/dynamic report, MITRE ATT&CK mapping included.

Parses a full-filesystem iOS extraction into readable, categorised forensic reports (messages, location, app usage, health data) — the standard open-source companion to a Cellebrite/GrayKey iOS acquisition.

python3 ileapp.py -t fs -i extraction/ -o report/

Parses NTFS INDX ($I30) directory index attributes — surfaces filenames and timestamps for files that have since been deleted from a directory.

python INDXParse.py -d \$I30 > indx.csv

Simulates common internet services (HTTP, DNS, SMTP, FTP…) so malware detonated in an isolated lab thinks it has internet access — captures every request it makes.

inetsim --data-dir /var/lib/inetsim/data

A threat-intel aggregation platform that fans a single observable (hash, IP, domain, URL) out to dozens of analyzers — VirusTotal, AbuseIPDB, YARA, sandboxes — and returns one combined report instead of querying each by hand.

Malware analysis platform built around code-reuse/genetic similarity — classifies a sample by comparing its compiled code fragments against known malware and software libraries.

Eric Zimmerman's jump list parser — extracts recently/frequently accessed files and applications from AutomaticDestinations/CustomDestinations jump-list files.

JLECmd.exe -d C:\Users\<u>\AppData\... --csv out

Deep-analysis malware sandbox with a free cloud-basic tier — hybrid static/dynamic/hypervisor-based analysis with especially detailed behaviour and evasion detection signals.

Network protocol analyzer focused on HTTP — logs requests/responses in a customisable format similar to a web server access log, straight off the wire.

justniffer -i eth0 -p "http.request.uri"

Kroll Artifact Parser and Extractor — targets collect and copy specific forensic artifacts (registry, event logs, prefetch, browser data…) and modules parse them, all in one fast pass.

kape.exe --tsource C: --tdest T:\triage --target !SANS_Triage --mdest M:\module --module !EZParser

Targeted collection and parsing of forensic artifacts from a live or imaged Windows system in minutes — pulls only the files that matter (registry hives, event logs, browser history, prefetch) instead of a full disk image.

kape.exe --tsource C: --tdest D:\triage --target !SANS_Triage

CERT.pl's distributed malware analysis pipeline framework — chains classifiers, unpackers and config extractors as independent workers around a shared task queue.

Checkmarx's open-source IaC security scanner — thousands of queries across Terraform, Kubernetes, Docker, CloudFormation and more, built on the same query engine as Checkmarx's SAST.

kics scan -p ./infra -o results/

A wireless network and device detector, sniffer and WIDS framework — covers WiFi, Bluetooth, and SDR-fed protocols well beyond what aircrack-ng alone monitors.

kismet -c wlan0

Aqua Security's tool for checking whether Kubernetes is deployed according to the CIS Kubernetes Benchmark — runs as a pod against the cluster's own components.

kube-bench run --targets node,policies

Hunts for security weaknesses in Kubernetes clusters — from inside a pod or from outside the network, probing the API server, kubelet and common misconfigurations.

kube-hunter --remote your-cluster-ip

ARMO's Kubernetes security platform — scans manifests, live clusters and container images against NSA/CISA hardening guidance, MITRE ATT&CK for containers and custom frameworks.

kubescape scan framework nsa

Eric Zimmerman's LNK (shortcut) file parser — recovers target paths, volume serials, MAC addresses and timestamps embedded in Windows shortcut files.

LECmd.exe -f target.lnk

WithSecure's framework for testing cloud detection and response by executing ATT&CK-mapped attack techniques against AWS/Azure/GCP, driven by simple YAML test definitions.

Library and CLI tools for reading/writing the Expert Witness Format (E01) used by EnCase/FTK — acquire, verify and mount E01 images from the command line.

ewfacquire /dev/sdb

Auto-discovering network monitoring platform — SNMP-based inventory and alerting across switches, routers, servers and more, a free alternative to commercial NMS suites.

SecOps cloud platform built from composable primitives — an EDR-grade sensor, detection & response rules, and log ingestion, priced and built for building your own security stack.

Loadable kernel module for full Linux memory acquisition over network or to local disk — the standard way to capture RAM from a live Linux host for forensic analysis.

insmod lime.ko "path=/mnt/usb/mem.lime format=lime"

Attacker C2 frameworks and lateral-movement tools frequently create distinctively named pipes; a mismatch against a known baseline is a fast lead.

[System.IO.Directory]::GetFiles("\.\pipe\")

Confirms what the current account itself has scheduled, useful both for enumeration and for spotting attacker persistence.

crontab -l

Confirms what a process is actually talking to right now, the fastest way to spot a live C2 beacon or an exfil channel.

ss -tnp state established

macOS persistence almost always lives in a LaunchAgent or LaunchDaemon plist — this lists every one across the user and system locations in one pass.

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

A quick sweep for a custom allow-rule that could be an attacker tunnel, or an admin forgotten backdoor port.

netsh advfirewall firewall show rule name=all dir=in | findstr /i "Rule Enabled Action LocalPort"

A malicious or unexpected MDM configuration profile can silently redirect DNS, install a root CA, or restrict settings; this lists everything currently installed.

profiles list -verbose

Quick cluster-wide audit for containers that do not need to run privileged or as root but do anyway — a top item on any container hardening review.

kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.spec.containers[].securityContext.privileged==true or .spec.securityContext.runAsUser==0) | "\(.metadata.namespace)/\(.metadata.name)"'

A process running from memory with a deleted or missing on-disk image is a strong process-injection/hollowing indicator — this osquery pulls exactly that condition.

osqueryi "SELECT pid, name, path, cmdline FROM processes WHERE on_disk = 0;"

Scheduled tasks are one of the most common Windows persistence mechanisms; this lists every task with its creation/last-run time so a recently added one stands out.

Get-ScheduledTask | Get-ScheduledTaskInfo |
  Sort-Object LastRunTime -Descending |
  Select-Object TaskName, LastRunTime, NextRunTime

Webshells and dropped files usually touch a file's mtime; this narrows a whole web root down to what changed in the suspected compromise window.

find /var/www -type f -mmin -1440 -printf '%TY-%Tm-%Td %TH:%TM %p\n' | sort

A service binary path an unprivileged user can overwrite is a classic privilege-escalation and persistence weakness; this narrows the whole service list down to that condition.

Get-WmiObject win32_service | Where-Object { $_.StartName -eq 'LocalSystem' } |
  Select-Object Name, DisplayName, PathName, StartMode

Watches SSH failed-password attempts as they happen — the manual, no-Fail2ban-installed version of noticing a brute-force in progress.

tail -f /var/log/auth.log | grep --line-buffered 'Failed password'

PowerShell module that scans Active Directory Certificate Services (AD CS) for the common ESC1-ESC8-style misconfigurations, and can remediate several of them automatically.

Invoke-Locksmith -Mode 2

Free triage tool that pulls and highlights the Windows Event Log entries and registry/config items that matter most for malicious activity detection and log hardening review.

Florian Roth's free IOC and YARA scanner — walks a filesystem checking file hashes, filenames, YARA signatures and known-bad registry/process indicators against a curated ruleset, for a quick compromise check on a single host.

python loki.py -p C:\

Commercial DFIR platform from Magnet Forensics — unifies computer, mobile and cloud artifact recovery with a single timeline/case view, common in corporate and LE forensics labs.

Free Windows RAM acquisition tool from Magnet Forensics — simple GUI, outputs a raw memory image suitable for Volatility or Magnet AXIOM.

Hex-editor-meets-static-analyzer built for malware and CTF work — combines hex view, disassembly, string extraction, entropy visualisation and YARA scanning in one IDE-like window.

CISA's network traffic analysis toolset — packages Zeek, Suricata and Arkime with an OpenSearch/Kibana front end into one Docker-composed stack, for a full-fidelity network monitoring deployment without building it component by component.

CERT.pl's Python library for malware config extraction and crypto/decoding primitives — the extraction engine behind mwdb/Karton pipelines for many malware families.

Static PE analysis tool aimed at malware triage — plugin architecture scores suspicious imports, packing, resources and sections and can run YARA rules over the binary.

manalyze --dump=all suspicious.exe

Mounts a memory dump (or a live target over PCILeech/DMA) as a virtual filesystem — processes, modules, handles and the registry become browsable files and directories instead of Volatility plugin output.

mount -f memory.dmp

Eric Zimmerman's $MFT parser — turns the NTFS Master File Table into CSV, revealing file creation/modification timestamps and deleted entries for timeline building.

MFTECmd.exe -f \$MFT --csv out

NetSPI's PowerShell toolkit for Azure security assessment — enumerates storage accounts, key vaults, automation accounts and other Azure resources for exposed secrets and misconfigurations.

Cloud-native SIEM/SOAR on Azure — Kusto (KQL) analytics rules, hunting queries and playbooks over log data collected from Azure, on-prem and other clouds.

SecurityEvent | where EventID == 4625 | summarize count() by Account, IpAddress | order by count_ desc

Open-source threat intelligence platform — stores, correlates and shares IOCs and events between organisations via a structured, taxonomy-tagged data model.

The ATT&CK knowledge base itself — tactics, techniques and real intrusion examples per adversary group — distinct from the interactive Navigator tool built on top of it.

Interactive matrix tool for exploring, annotating and layering the ATT&CK framework — used to map detections/coverage or plan a red-team engagement against real adversary techniques.

MITRE's automated adversary emulation platform — runs chained ATT&CK techniques against a target environment on a schedule, so a blue team can verify their detections actually fire rather than assuming they would.

MITRE's knowledge graph of defensive countermeasures, mapped against ATT&CK offensive techniques — the "other side" of ATT&CK for planning detections and mitigations.

A memory-anomaly scanner for detecting malware implants that leave no trace on disk — walks a process's virtual memory looking for the permission/backing-file inconsistencies that in-memory injection techniques produce.

Moneta64.exe -p 1234

Pre-recorded, ATT&CK-mapped security event datasets (from Roberto Rodriguez's OTR project) for practising detection engineering and hunting without needing your own attack lab.

CERT.pl's Malware Database — a sample repository and analysis pipeline hub that stores samples, configs and relations, feeding automated processing via Karton.

A widely deployed commercial vulnerability scanner (a free "Essentials" tier exists) — CVE-backed checks across a huge range of software and network devices, with policy-based scanning and reporting.

Open-source network management and discovery tool — maps switches, routers and connected devices via SNMP/CDP/LLDP for network asset inventory and port-tracing.

High-performance Linux network toolkit — zero-copy packet sniffer/analyzer/replay tool built around the kernel ring-buffer for capturing at line rate on busy links.

netsniff-ng --in eth0 --out capture.pcap

A passive network forensics tool that reconstructs sessions, files, credentials and host details straight out of a PCAP — built for pulling artifacts out of captured traffic rather than live monitoring.

Protocol reverse-engineering tool — infers the message format and state machine of an unknown or undocumented protocol from captured traffic samples.

NetFlow/IPFIX collection and analysis toolset — nfdump captures and filters flow records from the CLI, NfSen adds a web front-end with graphs and alerting on top.

nfdump -R /flows -o long 'src ip 10.0.0.5'

grep for network traffic — matches a regex against packet payloads live off an interface or a pcap file, handy for quickly spotting a known string in a stream of packets.

ngrep -q -d eth0 'password' tcp port 80

A Python wrapper around Sysinternals Procmon that auto-generates a concise, readable malware behaviour report — file, registry, network and process activity — from one run.

python Noriben.py

Real-time network traffic monitoring with a web dashboard — flow-level visibility, host and application breakdowns, and historical trending, positioned as a modern, browser-based successor to the original ntop.

ntopng -i eth0

Open Policy Agent and its Kubernetes admission-controller integration, Gatekeeper — write once, enforce policy-as-code rules that reject non-compliant resources before they are ever created.

opa eval -i input.json -d policy.rego "data.k8s.deny"

Thinkst's lightweight, low-interaction honeypot daemon — fakes a handful of common services (SSH, RDP, SMB, HTTP, a fake MySQL) just convincingly enough to alert the moment anything touches them, with almost no operational overhead.

opencanaryd --start

An open-source threat intelligence platform structured around the STIX2 data model — links indicators, malware, threat actors and campaigns as a knowledge graph rather than a flat feed of IOCs.

A full-featured open-source vulnerability scanning and management framework that grew out of the last open Nessus release — a free, self-hosted alternative for network-wide vulnerability assessment.

Facebook/Meta's endpoint agent that exposes an operating system's state (processes, users, open sockets, installed packages, scheduled tasks) as SQL tables — 'ask the OS a question' via SQL instead of a bespoke agent API.

osqueryi "SELECT pid, name, path FROM processes WHERE on_disk = 0;"

The original open-source host intrusion detection system that Wazuh forked from — log analysis, file integrity monitoring, rootkit detection and active response from a lightweight multi-platform agent.

Open Source Security Events Metadata project — a common data model and documentation for standardising log field meaning across platforms, so detections translate cleanly between tools.

In-depth attack-surface mapping and asset discovery — combines passive DNS/certificate-transparency sources with active DNS enumeration to build a graph of an organisation's external footprint, used defensively to find shadow-IT assets before an attacker does.

amass enum -d example.com

Passive OS and application fingerprinting from raw traffic characteristics (TCP/IP stack quirks) alone — identifies what is talking on the wire without sending a single probe packet.

p0f -i eth0

Free online pcap analysis service — upload a capture and get a Zeek-powered breakdown of connections, files, certificates and suspicious indicators without installing anything.

Duo Labs' AWS IAM policy linter — checks policy documents for syntax errors and known bad patterns before they get attached to a role.

parliament --file policy.json

Passive network asset mapping tool — builds an inventory of hosts, services and vulnerabilities purely by watching traffic, no active scanning that could disrupt fragile OT/ICS devices.

passer -i eth0

Generates a visual network diagram from a pcap — hosts, connections, Tor traffic and suspicious flows laid out graphically for a quick "what happened on this network" overview.

python PcapXray.py -f capture.pcap

hasherezade's scanner for detecting and dumping malicious implants (process hollowing, reflective DLL injection, shellcode) from a single running Windows process, recovering an unpacked copy for analysis.

pe-sieve64.exe /pid 1234

Eric Zimmerman's Windows Prefetch parser — turns .pf files into execution history (run count, last-run times, loaded files) for proving what ran on a host and when.

PECmd.exe -d C:\Windows\Prefetch --csv out

Open-source Python tool for static malware analysis of PE files — extracts strings, imports, indicators of packing and generic obfuscation with a simple CLI report.

peframe suspicious.exe

Static PE-file triage tool that surfaces imports, strings, resources and known-bad indicators in a suspicious Windows executable up front — designed specifically to be run without ever executing the sample.

TestDisk's companion file-carving tool — recovers files by signature from a raw disk image or damaged filesystem, ignoring the filesystem structure entirely, which makes it as useful for evidence recovery as for data recovery.

photorec /d recovered/ disk.dd

Network-wide DNS sinkhole — blocks ads and known-malicious domains at resolution time, and its query log doubles as a lightweight DNS monitoring/visibility tool for a home or small office network.

pihole -q malicious-domain.com   # check if/why a domain is being blocked

Framework for creating a "super timeline" from a forensic image — parses dozens of artifact formats into one chronologically sorted event stream for triage in Timesketch or a spreadsheet.

log2timeline.py timeline.plaso image.dd
psort.py -o l2tcsv -w timeline.csv timeline.plaso

Builds a "super timeline" from every timestamped artifact on a disk image or triage collection — filesystem metadata, registry, logs, browser history — merged into one chronological view for an investigator to filter.

log2timeline.py timeline.plaso disk.dd && psort.py -o l2tcsv -w timeline.csv timeline.plaso

NCC Group's tool for graphing AWS IAM — identifies privilege escalation paths between IAM principals so defenders can find and fix them before an attacker does.

pmapper graph create\npmapper analysis

Kubernetes cluster sanitizer — scans live resources for misconfigurations, deprecated APIs and potential issues, reporting a per-resource 'score' rather than only security findings.

popeye

Comsvcs.dll's MiniDump export, invoked through rundll32, dumps a process's memory using a Windows-signed DLL — a documented credential-access technique worth knowing defensively too.

rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <pid> C:\Windows\Temp\dump.dmp full

Sysinternals tool logging real-time file system, registry and process/thread activity — the standard way to see exactly what a suspicious process is doing on a live Windows host.

procmon.exe /BackingFile trace.pml /Quiet /Minimized

AWS (and multi-cloud) security best-practices assessment tool covering CIS benchmarks, GDPR, HIPAA and more, run as a CLI against a live account.

prowler aws

Extracts and de-duplicates every source/destination IP seen in a capture with tshark, without loading the whole file into Wireshark.

tshark -r capture.pcap -T fields -e ip.src -e ip.dst | tr '\t' '\n' | sort -u

Free threat-intelligence search engine that correlates indicators pulled from a wide range of open-source feeds into a single scored lookup.

Semperis' free Active Directory and Entra ID security assessment tool — checks for dozens of known attack paths and misconfigurations, scored and prioritised for remediation.

Python library implementing the Sigma rule specification and backend pipelines — what sigma-cli and most Sigma tooling is actually built on.

pip install pysigma pysigma-backend-splunk

Pulls recent 4625 (failed logon) events with account and source IP, straight from PowerShell — the first check on a suspected brute-force or password-spray.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 50 |
  Select-Object TimeCreated, @{n='Account';e={$_.Properties[5].Value}}, @{n='SourceIP';e={$_.Properties[19].Value}} |
  Format-Table -AutoSize

On systemd hosts, journalctl replaces grepping flat log files and filters directly by unit, priority and time window.

journalctl -u sshd --since "1 hour ago" -p warning

A ready-made osquery query for the classic Windows Run/RunOnce persistence locations — paste it into osqueryi or a scheduled pack.

osqueryi "SELECT * FROM registry WHERE path LIKE 'HKEY_USERS\\%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%';"

Event ID 4624 with LogonType 3 (network) or 10 (RDP) is the backbone of almost any lateral-movement timeline reconstruction.

wevtutil qe Security /q:"*[System[(EventID=4624)]]" /f:text /c:20

log show replaces syslog on modern macOS and can filter directly for authorization and authentication activity in a given window.

log show --predicate 'eventMessage contains "authentication"' --last 1h

Blue-team side of the download cradle above: ScriptBlock logging (event 4104) captures the deobfuscated command even when it arrived base64-encoded.

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" | Where-Object Id -eq 4104 | Select-Object -First 20 TimeCreated, Message

Eric Zimmerman's GUI registry hive viewer — bookmarked keys, deleted key recovery and a much friendlier interface than regedit for manual hive investigation.

Plugin-based Windows registry hive parser — runs a battery of small, purpose-built plugins over a hive (SAM, SYSTEM, SOFTWARE, NTUSER.DAT) to pull out exactly the keys an investigator actually looks for.

rip.pl -r SYSTEM -f system > system_report.txt

Takes a registry+filesystem snapshot before and after running a sample and diffs them — the quickest way to see exactly what a piece of malware changed on disk/registry.

Google's memory forensics framework, forked from an earlier Volatility codebase before the two diverged — live memory analysis and plugin-based artifact extraction.

Lenny Zeltser's curated Linux distribution for malware analysis — pre-installs the FLARE/community toolchain (FLOSS, Capa, YARA tooling, network fakers, deobfuscators) so an analyst is not assembling one tool at a time.

last reconstructs a login, logout and reboot timeline straight from wtmp, useful for confirming whether a suspicious session actually happened.

last -a | head -30
lastb | head -30

Active Countermeasures' open-source beaconing-detection tool — analyses Zeek logs for the regular-interval connection patterns that C2 beacons produce, surfacing them without needing signatures for the malware itself.

rita import /opt/zeek/logs/current mydataset

Framework for exploring and auditing Azure AD (Entra ID) — dumps the full directory into a local database, then browses/queries it offline for defensive review or misconfiguration hunting.

roadrecon gather\nroadrecon gui

A real-time log analysis and correlation engine designed to sit alongside Snort/Suricata, applying Snort-like rule syntax to log data so log events and network alerts can be correlated in one place.

sagan -c /usr/local/etc/sagan.yaml

Eric Zimmerman's shellbags parser — reconstructs folders a user browsed, even ones since deleted, from the registry's shellbag structures.

SBECmd.exe -d C:\Users\<u>\NTUSER.DAT --csv out

Fast, configurable file carver — reads a header/footer definition file to extract specific file types from an unallocated disk image or memory dump.

scalpel -c scalpel.conf -o carved/ image.dd

Multi-cloud security auditing tool that pulls configuration data from AWS/Azure/GCP/Alibaba via each provider's API and reports misconfigurations in a readable HTML report.

scout aws

When auditd is configured, ausearch turns its raw log into a readable timeline of exactly which process touched a watched file or syscall.

ausearch -k <watch-key> -ts recent

Root can read every user history file in one pass, useful in an incident-response sweep for a command that reveals lateral movement.

sudo find /home /root -name '.*_history' -exec sh -c 'echo == {} ==; cat {}' \;

On systemd hosts this finds a service that keeps crashing/restarting, which is often the visible symptom of a webshell or exploit repeatedly killing the parent process.

journalctl -u <service> --since '1 hour ago' | grep -Ei 'fail|restart|core dump'

Curated collection of publicly available security-relevant datasets (network captures, logs, malware metadata) for research and detection-engineering practice.

A free Linux distribution for network security monitoring and log management — bundles Zeek, Suricata, Wazuh and a full Elastic-based analyst UI into one deployable platform for a whole SOC stack.

Lists every Prefetch file with its last-modified time when a proper parser like PECmd is not available on the box you are triaging — a rough but immediate proxy for program execution history.

Get-ChildItem C:\Windows\Prefetch\*.pf | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime

Open-source SOAR — drag-and-drop playbooks that pull alerts, enrich IOCs and drive response actions across a SOC toolchain without paying for a commercial SOAR seat.

A generic, SIEM-agnostic signature format for describing log-based detections — write a detection once in Sigma YAML and convert it (via pySigma/sigma-cli) to Splunk, Elastic, QRadar or a dozen other query languages.

sigma convert -t splunk rule.yml

Neo23x0's public collection of YARA rules and IOCs used by Loki/THOR — a solid, actively maintained rule set to drop straight into your own scanner or SIEM.

CERT/CC's System for Internet-Level Knowledge — a netflow collection and analysis toolkit built for querying flow records at very large (ISP/enterprise-backbone) scale.

rwfilter --start-date=2026/09/03 --proto=6 --pass=stdout | rwstats --fields=dip --top --count=10

One of the original open-source network intrusion detection/prevention systems — a huge community rule-set ecosystem built up over more than two decades.

snort -A console -q -c /etc/snort/snort.conf -i eth0

Mandiant's Windows binary emulator for malware analysis — runs a sample's code against an emulated Windows API surface to observe its behaviour (registry, network, file activity) without a full sandbox VM or real execution.

speakeasy -t malware.exe -o report.json

Ranks host pairs by connection count as a quick, RITA-free first pass at spotting regular-interval C2 beaconing in Zeek connection logs.

zcat conn.log.gz | zeek-cut id.orig_h id.resp_h duration | sort | uniq -c | sort -rn | head

abuse.ch's SSL Blacklist — JA3/JA3s and certificate SHA1 fingerprints associated with malware C2, useful for detecting malicious TLS traffic without decrypting it.

Turbot's tool that exposes cloud provider APIs as SQL tables — write plain SQL to audit AWS/Azure/GCP/Kubernetes/GitHub configuration instead of writing bespoke API scripts.

steampipe query "select name, arn from aws_s3_bucket where not block_public_acls;"

Google's high-throughput full-packet-capture daemon — buffers traffic to disk on a rolling basis so that when an IDS fires, the packets behind the alert can still be pulled minutes or hours later.

Datadog's "Atomic Red Team for the cloud" — a library of self-contained, granular attack techniques against AWS/Azure/GCP (disable CloudTrail, create an access key, assume a role) for testing whether cloud detections actually catch them.

stratus detonate aws.persistence.iam-backdoor-role

A high-performance open-source network IDS/IPS and network security monitoring engine — multi-threaded, Snort-rule-compatible, with built-in protocol logging.

suricata -i eth0 -c /etc/suricata/suricata.yaml

Anchore's SBOM (Software Bill of Materials) generator for container images and filesystems — the package inventory that Grype and other scanners match CVEs against.

syft myapp:latest -o cyclonedx-json

The widely-adopted, well-commented baseline Sysmon configuration — a sane starting ruleset for logging high-value security events without drowning a SIEM in noise.

sysmon.exe -c sysmonconfig-export.xml

Olaf Hartong's modular Sysmon configuration — swap in only the event categories you need (process creation, network, WMI, DNS…) rather than one giant monolithic config file.

Community-maintained continuation of Process Hacker — deep process, service, network and driver inspection for live Windows triage, including terminating handles that a normal task manager cannot touch.

Deutsche Telekom's all-in-one honeypot platform — bundles Cowrie, Dionaea and a couple dozen other honeypots plus an ELK dashboard into one Docker-composed deployment, for a broad-spectrum sensor rather than a single service.

Captures data transmitted as part of TCP connections and reconstructs each stream into its own file — useful for pulling application-layer content back out of a live capture.

tcpflow -i eth0 -o flows/

Replays previously captured pcap traffic back onto a live network at controlled speed — used to test IDS/IPS/SIEM detection rules against known-bad traffic without re-attacking anything.

tcpreplay -i eth0 --mbps=10 malicious.pcap

Sysinternals GUI showing every active TCP/UDP endpoint with the owning process — a quick live-response check for unexpected outbound connections.

Static IaC security scanner covering Terraform, Kubernetes, Helm and CloudFormation — policy-as-code rules (OPA-based) catch misconfigurations before they reach production.

terrascan scan -i terraform -d ./infra

Free partition recovery and repair tool — rebuilds lost partition tables and boot sectors, a first step before deeper forensic imaging of a damaged disk.

testdisk image.dd

Cilium's eBPF-based security observability and runtime enforcement tool — real-time visibility into process execution, file and network activity with the option to block, not just alert.

Scalable, open-source Security Incident Response Platform — cases, tasks, observables and templated playbooks for a SOC/CSIRT team working alerts together.

Curated repository of live malware samples for research and defence testing — clearly labelled and deliberately hard to run by accident.

Nextron Systems' free edition of their commercial THOR APT scanner — a faster, more actively maintained successor to Loki, built to sweep a host for the same class of compromise indicators and YARA hits.

abuse.ch platform for sharing indicators of compromise (IOCs) — malicious IPs, domains and URLs tied to specific malware families, free to query via API.

Merges failed and successful SSH authentication lines into one chronological view, the fastest way to spot a brute-force run that ends in a successful login.

grep -E 'Failed password|Accepted password' /var/log/auth.log

Google's collaborative timeline-analysis platform — ingests Plaso timelines (and other sources) into a searchable, shareable web UI so a team can annotate and correlate events instead of grepping one giant CSV alone.

A quick awk pipeline that ranks source IPs by request count, the first thing to run on a log suspected of scanning or brute-force traffic.

awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20

Aqua Security's eBPF-based Linux runtime security and forensics tool — traces syscalls and events with a rules engine for detecting suspicious container/host behaviour live.

tracee --output json

Hatching's automated malware sandbox — detonates a submitted sample across multiple Windows/Linux/Android profiles and returns behavioural reports, extracted configs and IOCs, with a free tier for public submissions.

Aqua Security's all-in-one scanner — container images, filesystems, IaC and git repos for known CVEs, secrets and misconfigurations, fast enough to run in every CI pipeline.

trivy image myapp:latest

Google's automation framework for running forensic tools (Plaso, bulk_extractor, YARA and more) as a distributed pipeline against cloud-scale evidence, so a large IR engagement is not bottlenecked on one analyst's workstation.

A live-response shell script for Linux, macOS, AIX and Solaris that collects volatile and forensic artifacts (processes, network state, logs, persistence points) into a single archive — the Unix-world counterpart to KAPE.

./uac -p full /tmp/triage

Unofficial iOS backup extractor — pulls an unencrypted or password-known iTunes-style backup off a device and organises it for handoff to iLEAPP or manual review.

SOC Prime's free online translator between Sigma, SPL, KQL, EQL, YARA-L and other query languages — paste a Sigma rule, get a ready query for your SIEM.

abuse.ch project tracking URLs actively distributing malware, with a searchable database and downloadable blocklists for defensive use.

Free sandboxed URL scanner that renders a page, records every request it makes, and archives screenshots and the DOM — used to safely inspect a suspicious link before clicking it.

Security Risk Advisors' free platform for tracking purple team exercises — records which attack techniques were run, what was detected, and where a gap needs a new rule.

Endpoint visibility and DFIR platform — a query language (VQL) for hunting across a fleet of endpoints, collecting artifacts and monitoring in near-real-time rather than imaging one box at a time.

velociraptor -v --config server.config.yaml frontend

A quick way to confirm whether a binary someone dropped is signed and by whom, before deciding whether to trust or detonate it.

certutil -verify -urlfetch payload.exe

codesign confirms whether a binary is signed at all and by whom, and lists exactly what it is entitled to do at runtime.

codesign -dv --verbose=4 /Applications/Suspicious.app
codesign -d --entitlements :- /Applications/Suspicious.app

On a system with module signing enforced, an unsigned loaded module is close to a smoking gun for tampering.

for m in $(lsmod | awk 'NR>1{print $1}'); do modinfo $m | grep -q '^sig_id' || echo "unsigned: $m"; done

Multi-engine file/URL/domain/IP reputation lookup aggregating dozens of AV engines and sandboxes — the standard first stop for triaging a suspicious sample or link.

The standard open-source memory forensics framework — extracts processes, network connections, injected code and more from a RAM capture across Windows, Linux and macOS.

vol -f memdump.raw windows.pslist

Free GUI front-end for the Volatility memory forensics framework — point-and-click access to plugins for analysts who prefer not to live in the CLI.

Large public archive of malware samples, source code leaks and research papers — the go-to reference library for malware researchers looking up a family or campaign.

A free, open-source XDR/SIEM platform — log analysis, file integrity monitoring, vulnerability detection and rootcheck/rootkit detection from a fleet of lightweight agents, built as an OSSEC fork with a modern stack around it.

wevtutil is the signed, built-in way to clear an event log channel — worth knowing for blue-team log-tampering detection just as much as red-team tradecraft.

wevtutil cl Security

Free, open-source Windows memory acquisition tool — dumps physical RAM to a raw or AFF4 image for later Volatility/Rekall/MemProcFS analysis.

winpmem.exe memory.raw

The world's most widely used network protocol analyzer — deep inspection of hundreds of protocols, live capture and offline analysis, with a filter language everyone in the field eventually learns.

wireshark -i eth0 -k

Lightweight, fast commercial disk forensics suite — a long-standing favourite among examiners for its speed and low resource footprint on very large images compared to heavier platforms.

Network forensic analysis tool (NFAT) — reconstructs application-layer content (emails, VoIP calls, HTTP content, chat) from a pcap for post-capture investigation.

CERT NetSA's IPFIX-compliant flow generator — turns raw pcap into flow records with deep packet inspection metadata for downstream SiLK-style analysis.

yaf --in capture.pcap --out flow.yaf --silk

A pattern-matching engine purpose-built for malware research — write rules describing families of malicious files, then scan a filesystem or memory image against them at speed.

yara rules.yar suspicious_file

VirusTotal's ground-up Rust rewrite of the YARA scanning engine — a drop-in-compatible, faster and memory-safer replacement for the original C implementation, maintained by the same team.

yr scan rules.yar sample.bin

Generates YARA rules from a set of malware samples, using string frequency scoring against a large goodware corpus to avoid noisy, false-positive-prone signatures.

python3 yarGen.py -m /malware_samples/ -o generated.yar

"Your Everyday Threat Intelligence" — a platform for aggregating and de-duplicating observables, TTPs and threat data from multiple feeds into one queryable, taggable repository for an analyst team to build on.

Enterprise-grade open-source monitoring platform — network, server and application monitoring with alerting, widely used as the backbone of an internal visibility/blue-team baseline.

A network security monitor rather than a signature-matching IDS — transforms traffic into rich, structured logs (connections, DNS, HTTP, files…) that a SOC actually hunts through.

zeek -r capture.pcap

A standalone SIGMA detection engine for EVTX (and Sysmon-for-Linux/auditd JSON) — runs the same Sigma rule set as a SIEM directly against exported logs when there is no SIEM to hand.

python3 zircolite.py --evtx evtx_dir/ --ruleset rules/rules_windows_generic.json

An internet-wide, single-packet network scanner built for research-scale sweeps of the whole IPv4 address space on a single port, rather than deep per-host scanning of a target list.

zmap -p 443 -o results.csv