Bookmarks Menu

Bookmarks Toolbar SOC Bookmarks Phishing Analysis Domain Analysis Whois.com Whois Lookup - DomainTools Reverse IP Lookup - DomainTools Reverse IP Lookup - MxToolbox CentralOps Domain Dossier Have I Been Squatted? Cisco Talos - IP and Domain Reputation Center Email Header Analysis Message Header Analyzer Email Header Analyzer, RFC822 Parser - MxToolbox Google Admin Toolbox 13Cubed/EmailHeader: A Sublime Text 3 syntax highlighting plugin for email message headers. Email-IOC-Extractor: A Python script for analyzing email files to extract IP addresses, URLs, headers, and attachments, with functionalities for defanging IPs and URLs, IP lookup, and attachment details extraction. URL Analysis URLScan.io URL2PNG - Screenshots as a Service VirusTotal - URL Submission Unshorten.It URLVoid Wannabrowser Cisco Talos Intelligence CheckPhish WebCheck Threatcop - Phishing URL Checker Google Safe Browsing - Google Transparency Report URLhaus | Malware URL Exchange CyberGordon BrightCloud IPinfo Palo Alto - Test A Site Symantec WebPulse AbuseIPDB elceef/dnstwist: Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation Attachment Analysis VirusTotal - File Submission Cisco Talos Intelligence Group - Comprehensive Threat Intelligence DidierStevensSuite/emldump.py at master · DidierStevens/DidierStevensSuite DidierStevensSuite/oledump.py at master · DidierStevens/DidierStevensSuite DidierStevensSuite/pdf-parser.py at master · DidierStevens/DidierStevensSuite DidierStevensSuite/pdfid.py at master · DidierStevens/DidierStevensSuite Dynamic Attachment Analysis Hybrid Analysis Joe Sandbox Cloud Basic ANY.RUN Cuckoo Sandbox Automated Analysis PhishTool EML Analyzer CyberChef Phishing Samples PhishTank OpenPhish PhishCheck MalwareBazaar | Malware Sample Exchange rf-peixoto/phishing_pot: A collection of phishing samples for researchers and detection developers. Network Security Wireshark Wireshark.org Wireshark - Documentation CaptureFilters - Wireshark Wiki 4.10. Filtering while capturing DisplayFilters - Wireshark Wiki 6.4. Building Display Filter Expressions Snort Snort - Network Intrusion Detection & Prevention System chrisjd20/Snorpy: Snorpy is a python script the gives a Gui interface to help those new to snort create rules. Snorpy 2.0 - Web Based Snort Rule Creator PCAP Samples Malware Traffic Analysis - PCAP and Malware Samples Security Onion - PCAPs for Testing Netresec - Public PCAPs Wireshark Wiki - SampleCaptures thongsia/Public-Pcaps chrissanders/packets: Packet Captures Endpoint Security Sysinternals Sysinternals - Sysinternals | Microsoft Learn Autoruns - Sysinternals | Microsoft Learn DiskMon - Sysinternals | Microsoft Learn LogonSessions - Sysinternals | Microsoft Learn ProcDump - Sysinternals | Microsoft Learn Process Explorer - Sysinternals | Microsoft Learn Process Monitor - Sysinternals | Microsoft Learn PsLoggedOn - Sysinternals | Microsoft Learn Sysmon - Sysinternals | Microsoft Learn TCPView for Windows - Sysinternals | Microsoft Learn RegMon - Sysinternals | Microsoft Learn Sysmon Sysmon GitHub - SwiftOnSecurity/sysmon-config: Sysmon configuration file template with default high-quality event tracing GitHub - olafhartong/sysmon-modular: A repository of sysmon configuration modules Windows Events wevtutil | Microsoft Learn Get-WinEvent (Microsoft.PowerShell.Diagnostics) - PowerShell | Microsoft Learn Creating Get-WinEvent queries with FilterHashtable - PowerShell | Microsoft Learn Appendix L - Events to Monitor | Microsoft Learn GitHub - p0w3rsh3ll/AutoRuns: 🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence. Crontab.guru - The cron schedule expression generator LimaCharlie Hunt Evil | SANS Poster SIEM Common Attack Signatures HTML URL Encoding Reference GitHub - swisskyrepo/PayloadsAllTheThings: A list of useful payloads and bypass for Web Application Security and Pentest/CTF XSS Payload List SQL Injection Payload List XXE Injection Payload List Command Injection Payload List LFI and RFI Payload List Log Analysis jq GitHub - logpai/awesome-log-analysis: A list of awesome research on log analysis, anomaly detection, fault localization, and AIOps HTTP response status codes - HTTP | MDN regex101: build, test, and debug regex Parse a user agent - WhatIsMyBrowser.com Splunk Splunk | The Key to Enterprise Resilience Splunk Enterprise Free Trial | Splunk Download Universal Forwarder for Remote Data Collection | Splunk Understanding SPL syntax - Splunk Documentation Command quick reference - Splunk Documentation Create and edit reports - Splunk Documentation Getting started with alerts - Splunk Documentation Create dashboards and panels - Splunk Documentation Splunk Boss of the SOC GitHub - splunk/botsv1 GitHub - splunk/botsv2: Splunk Boss of the SOC version 2 dataset. GitHub - splunk/botsv3: Splunk Boss of the SOC version 3 dataset. Threat Intelligence Frameworks Cyber Kill Chain® | Lockheed Martin Unified Kill Chain: Raising Resilience Against Cyber Attacks MITRE ATT&CK® Matrix - Enterprise | MITRE ATT&CK® D3FEND Matrix | MITRE D3FEND™ National Council of ISACs The Diamond Model of Intrusion Analysis Building Threat Hunting Strategies with the Diamond Model - Active Response Threat Intelligence Tools Cisco Popularity List GreyNoise HoneyDB Community Projects - RiskAnalytics PhishTank | Join the fight against phishing Free threat intelligence feeds - threatfeeds.io ThreatFox | Share Indicators Of Compromise (IOCs) GitHub - Yara-Rules/rules: Repository of yara rules Malware Bazaar URLHaus AbuseIPDB Cisco Talos VirusTotal Maltego MISP Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing LevelBlue - Open Threat Exchange Protocols and References NVD - Search and Statistics CVE - CVE Traffic Light Protocol (TLP) Definitions and Usage | CISA STIX - Structured Threat Information Expression (Archive) | STIX Project Documentation Trusted Automated eXchange of Indicator Information (TAXII™) | TAXII Project Documentation GitHub - hslatman/awesome-threat-intelligence: A curated list of Awesome Threat Intelligence resources GitHub - P3t3rp4rk3r/Threat_Intelligence: Threat-Intelligence Feeds & Tools & Frameworks Digital Forensics Forensics Processes NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response - nistspecialpublication800-86.pdf Order of Volatility - Computer Forensics Recruiter Windows Forensic Analysis | SANS Poster Digital Forensics Tools EricZimmerman (Eric) · GitHub Eric Zimmerman's tools FTK Imager - Forensic Data Imaging and Preview Solution | Exterro Download WinPrefetchView - MajorGeeks Kroll Artifact Parser And Extractor (KAPE) | Cyber Risk | Kroll Home of The Volatility Foundation | Volatility Memory Forensics - The Volatility Foundation - Promoting Accessible Memory Analysis Tools Within the Memory Forensics Community Autopsy - Digital Forensics The Sleuth Kit (TSK) & Autopsy: Open Source Digital Forensics Tools GitHub - microsoft/avml: AVML - Acquire Volatile Memory for Linux dcfldd awesome-incident-response: A curated list of tools for incident response Windows Artifacts | HackTricks List of file signatures - Wikipedia Overview of FAT, HPFS, and NTFS File Systems - Windows Client | Microsoft Learn Incident Response Incident Response Tools GitHub - sans-blue-team/DeepBlueCLI GitHub - Velocidex/velociraptor: Digging Deeper.... GitHub - diogo-fernan/ir-rescue: A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response. TheHIve Incident Response Processes Computer Security Incident Handling Guide - nist.sp.800-61r2.pdf SP 800-61 Rev. 2, Computer Security Incident Handling Guide | CSRC SANS Incident Response Cycle NVD - Vulnerability Metrics Incident Response Playbooks GitHub - aws-samples/aws-incident-response-playbooks at 0d9a1c0f7ad68fb2c1b2d86be8914f2069492e21 incident-response-plan-template/playbooks at master · counteractive/incident-response-plan-template · GitHub GitHub - guardsight/gsvsoc_cirt-playbook-battle-cards: Cyber Incident Response Team Playbook Battle Cards GitHub - certsocietegenerale/IRM: Incident Response Methodologies 2022 GitHub - OTRF/ThreatHunter-Playbook: A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient. Incident Timelines GitHub - log2timeline/plaso: Super timeline all the things GitHub - cyb3rfox/Aurora-Incident-Response: Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders GitHub - meirwah/awesome-incident-response: A curated list of tools for incident response