Phill Moore

Awesome-BEC. Repository of attack and defensive information for Business Email Compromise investigations

detections. Shell

googleURLParser. parser for Google search strings

4n6_stuff. Git for me to put all my forensics stuff

block-parser. Parser for Windows PowerShell script block logs

regripper_gui. GUI for regripper

homespeak. Script for querying Google home devices

iOS-Parsers. parsers for iOS forensic artefacts

ParseiOSSpotify. Parsing the Recently Played file on the iOS Spotify app

exfat_stuff. Exfat documentation and scripts

MacForensics. A repo for the scripts and research regarding OS X Forensics

Regripper-Plugins. Repo for my regripper plugins

sqlite-to-json-python. Convert sqlite databases to JSON files

OLE_Research. Repo for my research into jumplist tools

SundayFunday. scripts written for HECFBlogs Sunday Funday challenges

tool_downloader. Perl

TheDefendersGuide. The Github project for The Defender's Guide by Luke Paine and Jonathan Johnson

parse_tasks. PowerShell

SQLECmd. C#

evtx. C# based evtx parser with lots of extras

randomaccess3.github.io. Github IO

velociraptor-docs. Documentation site for Velociraptor

entropy_plot. Python

RMM-Catalogue.

sigma. Main Sigma Rule Repository

INDXRipper. Carve file metadata from NTFS index ($I30) attributes

velociraptor-detections.

LOLRMM. LotL RMM

bmc-tools. RDP Bitmap Cache parser

uac. UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

randomaccess3. Homepage

bulk_extractor. This is the development tree. Production downloads are at:

DFIR_Ransomware_Project.

KapeFiles. This repository serves as a place for community created Targets and Modules for use with KAPE.

pykapetargetexec. Python runner for kape modules