Airbus CERT

Repositories

• regrippy

  A modern Python-3-based alternative to RegRipper

  python windows registry forensics dfir
  Python Apache-2.0 9 113 0 1 Updated Jan 6, 2021

• dnYara

  A multi-platform .Net wrapper library for the native Yara library.
  C# Apache-2.0 6 24 0 0 Updated Dec 17, 2020

• etl-parser

  Event Trace Log file parser in pure Python

  python windows forensics dfir
  Python Apache-2.0 9 64 2 1 Updated Nov 27, 2020

• Winshark

  A wireshark plugin to instrument ETW

  pcap wireshark etw
  Lua Apache-2.0 28 176 1 0 Updated Nov 26, 2020

• libpcap

  Forked from the-tcpdump-group/libpcap

  the LIBpcap interface to various kernel packet capture mechanism
  C 595 0 0 0 Updated Nov 26, 2020

• Splunk-ETW

  A Splunk Technology Add-on to forward filtered ETW events.

  windows dfir etw splunk-addon
  C# Apache-2.0 2 23 1 0 Updated Oct 14, 2020

• etwbreaker

  An IDA plugin to deal with Event Tracing for Windows (ETW)

  ida etw
  Python Apache-2.0 14 38 0 0 Updated Jun 2, 2020

• yara

  Forked from VirusTotal/yara

  The pattern matching swiss knife
  C BSD-3-Clause 932 1 0 0 Updated May 25, 2020

• comida

  An IDA Plugin that help analyzing module that use COM
  Python Apache-2.0 13 82 0 0 Updated May 13, 2020

• idaplugins-list

  Forked from onethawt/idaplugins-list

  A list of IDA Plugins
  456 0 0 0 Updated Apr 21, 2020

• cacdec

  The hidden mstsc recorder player

  windows forensics rdp
  Python 4 20 0 0 Updated Mar 9, 2020

• mispy

  Another MISP module for Python

  misp
  Python Apache-2.0 4 11 1 0 Updated Feb 17, 2020

• PSTrace

  Trace ScriptBlock execution for powershell v2

  powershell incident-response forensics dfir etw
  C Apache-2.0 4 31 0 0 Updated Jan 14, 2020

• MISP

  Forked from MISP/MISP

  MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)
  PHP AGPL-3.0 942 0 0 0 Updated Jan 3, 2020

• timeliner

  A rewrite of mactime, a bodyfile reader

  forensics dfir mactime bodyfile
  Go Apache-2.0 4 23 0 0 Updated Dec 16, 2019

• bodyfile

  A bodyfile parsing library

  golang forensics dfir mactime bodyfile
  Go 1 0 0 0 Updated Dec 16, 2019

• mispgo

  Golang library for MISP

  misp
  Go Apache-2.0 3 0 0 0 Updated Nov 22, 2019

• sysmon-config

  Forked from SwiftOnSecurity/sysmon-config

  Sysmon configuration file template with default high-quality event tracing
  918 0 0 0 Updated Jun 12, 2019

• MISP-STIX-Converter

  Forked from MISP/MISP-STIX-Converter

  A utility repo to assist with converting between MISP and STIX formats
  Python LGPL-3.0 26 0 0 0 Updated Nov 12, 2018

• grpc-gateway

  Forked from grpc-ecosystem/grpc-gateway

  gRPC to JSON proxy generator following the gRPC HTTP spec
  Go BSD-3-Clause 1,301 1 0 0 Updated Jan 16, 2018