Blue - DFIR: Digital Forensics and Incident Response

DFIR resources for incident response, forensic triage, Windows and Linux commands, memory forensics, malware analysis, and evidence collection.

DFIR focuses on evidence, timelines, containment, eradication, and recovery after suspicious activity or a confirmed compromise. This section is for hands-on incident response and forensic analysis: remote triage, host commands, event logs, evidence collection, memory forensics, sandboxing, file analysis, malware analysis, and reverse engineering.

For detection engineering, SIEM rules, and Sysmon configuration, use Event Detection. For reputation and enrichment lookups, use Threat Data.

Event DetectionThreat Data

DFIR Resource Collections

• DFIR Compendium - Broad DFIR tool and reference collection.

• Infosec Reference: DFIR - Large collection of DFIR guides, articles, and tools.

• DFIR start.me - Curated DFIR bookmark collection.

• Jaiminton DFIR Cheatsheet - DFIR commands and methodology.

• Awesome Incident Response

• Awesome Forensics

• Awesome KAPE

• Awesome Malware Analysis

Training, CTFs, labs, and course links have moved to Training.

Training and Resources

Incident Response Process

• RE&CT Framework - Actionable incident response techniques and capability mapping.

  • atc-react GitHub

  • atc-data GitHub

• CERT Société Générale IRM - Public incident response methodologies.

• SANS Incident Handler's Handbook

• SANS Incident Response Process - Preparation, identification, containment, eradication, recovery, and lessons learned.

• NIST SP 800-61 Rev. 2 - Computer Security Incident Handling Guide.

• Exabeam Incident Response Guide

• Zeltser DDoS Incident Cheat Sheet

• Syntax IR Playbooks

• Microsoft Incident Response Playbooks

  • Azure AD Incident Response PowerShell Module

  • Incident Response in a Microsoft Cloud Environment

Report Writing and Documentation

• Aurora Incident Response - IR documentation templates.

• PagerDuty Incident Response Templates

• Zeltser Incident Survey Cheat Sheet

• Zeltser CTI and IR Report Template

Host Collection and IR Frameworks

• Kansa - PowerShell-based incident response framework for collecting data across Windows hosts.

• Windows Forensic Toolchest - Structured live forensic response and audit collection.

• Velociraptor - Endpoint visibility, collection, and response platform.

  • Velociraptor Deep Dive

• Meerkat - PowerShell modules for Windows artifact gathering and reconnaissance.

• Cado Community Edition - Cloud-focused investigation and evidence processing.

• AWS_IR - Command-line utility for AWS incident response.

• ADTimeline - Active Directory replication metadata timeline generator.

• GRR Rapid Response - Remote live forensics framework.

• PowerForensics - PowerShell framework for disk forensic analysis.

  • PowerForensics Docs

Malware and IR Scanners

• Malwarebytes Incident Response

• ClamAV - Open-source antivirus engine.

• Microsoft Safety Scanner - On-demand malware removal scanner.

• hashlookup-forensic-analyser - Analyze files against CIRCL hashlookup.

• CobaltStrikeScan - Cobalt Strike beacon scanning and config parsing.

• System Informer - Successor to Process Hacker for process, handle, service, and module investigation.

• Windows Defender MpCmdRun - Defender command-line scanner.

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File C:\Users\[username]\AppData\Local\Temp

YARA, Loki, THOR Lite, Fenrir, and Binalyze IREC are maintained on the YARA page.

YARA

Memory scanners such as pe-sieve are maintained with memory forensics.

Memory Forensics

DFIR Commands

Interact with remote machineWindows System EnumerationWindows Process InformationWindows DFIR ChecksWindows DFIR Check by MITRE TacticWindows Event LogsIR Event Log CheatsheetWindows Remediation CommandsLinux DFIR CommandsMacOS DFIR Commands

Forensic Workstations and Frameworks

• SIFT Workstation - SANS forensic workstation for detailed digital forensic examinations.

  • SANS DFIR Posters and Cheat Sheets

  • Read-Only Mounting with SIFT

  • Filesystem and Registry Timeline Creation

  • Super Timeline Creation

• Tsurugi Linux - DFIR Linux distribution with OSINT tooling.

  • tsurugi_acquire

  • bento

  • Tsurugi Tools Listing

• Autopsy - Open-source forensic platform.

• X-Ways Forensics - Commercial forensic suite.

  • X-Ways X-Tensions

  • CrowdStrike X-Ways YARA Scanner

  • X-Ways Imager

• FTK - Commercial forensic suite.

  • FTK Imager

• The Sleuth Kit

  • sleuthkit.org

• NTDSxtract - Active Directory forensic framework.

• linux-explorer - Live forensics toolbox for Linux endpoints.

  • Installation and Configuration Video

• Eric Zimmerman's Tools - Windows forensic artifact tools.

  • Eric Zimmerman Tool Guide

  • KAPE

  • KAPE Docs

54KB

EricZimmermanCommandLineToolsCheatSheet-v1.0.pdf

PDF

Open

File Systems, Imaging, and Recovery

Detailed file analysis and carving guidance lives on File/Binary Analysis.

File/Binary Analysis

Useful extraction and recovery tools:

• bulk_extractor

• RegRipper

• safecopy

• dumpzilla

• xortool

• forensics-colorize

• dislocker

• mac-robber

• testdisk

• unhide

• Foremost

• scalpel

• RdpCacheStitcher

• bmc-tools

Forensic imaging:

• FTK Imager

• dd

• dc3dd

• dcfldd

• ddrescue

• X-Ways Imager

• guymager

dd.exe --list
dd.exe if=/dev/<drive> of=Image.img bs=1M
dd.exe if=\\.\<OSDrive>: of=<drive>:\<name>.img bs=1M --size --progress
sudo dd if=/dev/<OSDrive> of=/mnt/<name>.ddimg bs=1M conv=noerror,sync

Platform-Specific Forensics

Windows, Linux, and macOS command references are linked above. macOS artifact resources:

• Mac OS X 10.9 Forensics Wiki - Legacy macOS artifact reference.

• Mac OS X 10.11 Forensics Wiki - Legacy macOS artifact reference.

• macOS Forensics Artifacts Spreadsheet

• osxcollector

• automactc

• Mac4n6

• mac_apt

• The Mitten Mac Tools

Malware Analysis and Reverse Engineering

Malware analysis resources are split by workflow:

MalwareSandboxingReverse Engineering

Analyze malware in an isolated VM or lab network. Do not detonate samples on production systems.

Legacy / Deprecated Tools

These are kept for historical reference or specific legacy cases.

• Redline by FireEye/Mandiant - Legacy host investigation tool. Original FireEye links may no longer be maintained.

• CrowdResponse - Static host data collection tool.

• Gmer Rootkit Scanner - Rootkit detection/removal utility.

• chkrootkit - Local Unix rootkit checks.

• RKHunter - Unix rootkit scanner.

• Galleta - Internet Explorer cookie file analysis.

• Pasco - Internet Explorer cache file analysis.

• herdProtect - Legacy second-opinion cloud malware scanner; verify availability before use.