content overhaul
This commit is contained in:
overcuriousity
2156
src/data/tools-untagged.yaml
Normal file
2156
src/data/tools-untagged.yaml
Normal file
File diff suppressed because it is too large
Load Diff
@@ -27,6 +27,8 @@ tools:
|
||||
- carving
|
||||
- artifact-extraction
|
||||
- keyword-search
|
||||
- scenario:file_recovery
|
||||
- scenario:browser_history
|
||||
related_concepts:
|
||||
- SQL Query Fundamentals
|
||||
- Hash Functions & Digital Signatures
|
||||
@@ -37,7 +39,6 @@ tools:
|
||||
license: Apache 2.0
|
||||
knowledgebase: false
|
||||
- name: Volatility 3
|
||||
icon: 📦
|
||||
type: software
|
||||
description: >-
|
||||
Das Universalwerkzeug der Live-Forensik, unverzichtbar für die Analyse von
|
||||
@@ -47,6 +48,9 @@ tools:
|
||||
erweiterbar, erfordert aber solide Kommandozeilen-Kenntnisse. Version 3
|
||||
bringt deutliche Performance-Verbesserungen und bessere
|
||||
Formatunterstützung.
|
||||
skillLevel: advanced
|
||||
url: https://www.volatilityfoundation.org/
|
||||
icon: 📦
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
@@ -55,21 +59,8 @@ tools:
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- Windows
|
||||
- Linux
|
||||
- macOS
|
||||
related_concepts:
|
||||
- Hash Functions & Digital Signatures
|
||||
- Regular Expressions (Regex)
|
||||
related_software: null
|
||||
domain-agnostic-software: null
|
||||
skillLevel: advanced
|
||||
accessType: download
|
||||
url: https://www.volatilityfoundation.org/
|
||||
projectUrl: ''
|
||||
license: VSL
|
||||
knowledgebase: false
|
||||
scenarios:
|
||||
- scenario:memory_dump
|
||||
tags:
|
||||
- commandline
|
||||
- memory
|
||||
@@ -77,6 +68,16 @@ tools:
|
||||
- artifact-extraction
|
||||
- scripting
|
||||
- process-analysis
|
||||
related_concepts:
|
||||
- Hash Functions & Digital Signatures
|
||||
- Regular Expressions (Regex)
|
||||
platforms:
|
||||
- Windows
|
||||
- Linux
|
||||
- macOS
|
||||
accessType: download
|
||||
license: VSL
|
||||
knowledgebase: false
|
||||
- name: TheHive 5
|
||||
icon: 🌐
|
||||
type: software
|
||||
@@ -1484,7 +1485,7 @@ tools:
|
||||
icon: 📦
|
||||
type: software
|
||||
description: >-
|
||||
Der Windows-Registry-Experte mit hunderten Plugins für automatisierte
|
||||
Der scenario:windows-registry-Experte mit hunderten Plugins für automatisierte
|
||||
Analyse. Extrahiert USB-Historie, installierte Software,
|
||||
Benutzeraktivitäten und Malware-Spuren. Die Plugin-Architektur erlaubt
|
||||
maßgeschneiderte Untersuchungen für spezielle Fälle. Spart Stunden
|
||||
@@ -1753,7 +1754,7 @@ tools:
|
||||
Windows-Forensik. Ermöglicht Remote-Zugriff auf Windows-Systeme für
|
||||
Live-Forensik und IR. Die Skript-Sammlung deckt von SMB-Enumeration bis
|
||||
Kerberos-Attacks alles ab. Unverzichtbar für die Untersuchung von Lateral
|
||||
Movement und Persistence.
|
||||
Movement und scenario:persistence.
|
||||
domains:
|
||||
- incident-response
|
||||
- network-forensics
|
||||
@@ -2209,27 +2210,27 @@ domain-agnostic-software:
|
||||
name: Betriebssysteme
|
||||
description: Operating Systems which focus on forensics
|
||||
scenarios:
|
||||
- id: disk_imaging
|
||||
- id: scenario:disk_imaging
|
||||
icon: 💽
|
||||
friendly_name: Datenträgerabbild
|
||||
- id: memory_dump
|
||||
- id: scenario:memory_dump
|
||||
icon: 🧠
|
||||
friendly_name: RAM-Analyse
|
||||
- id: file_recovery
|
||||
- id: scenario:file_recovery
|
||||
icon: 🗑️
|
||||
friendly_name: Datenrettung
|
||||
- id: browser_history
|
||||
- id: scenario:browser_history
|
||||
icon: 🌍
|
||||
friendly_name: Browser-Spuren
|
||||
- id: credential_theft
|
||||
- id: scenario:credential_theft
|
||||
icon: 🛑
|
||||
friendly_name: Zugangsdiebstahl
|
||||
- id: remote_access
|
||||
- id: scenario:remote_access
|
||||
icon: 📡
|
||||
friendly_name: Fernzugriffe
|
||||
- id: persistence
|
||||
- id: scenario:persistence
|
||||
icon: ♻️
|
||||
friendly_name: Persistenzsuche
|
||||
- id: windows-registry
|
||||
- id: scenario:windows-registry
|
||||
icon: 📜
|
||||
friendly_name: Registry-Analyse
|
||||
friendly_name: Registry-Analyse
|
||||
|
||||
@@ -1,177 +1,83 @@
|
||||
tools:
|
||||
- name: Rapid Incident Response Triage on macOS
|
||||
icon: 📋
|
||||
type: method
|
||||
description: >-
|
||||
Spezialisierte Methodik für die schnelle Incident Response auf
|
||||
macOS-Systemen mit Fokus auf die Sammlung kritischer forensischer
|
||||
Artefakte in unter einer Stunde. Adressiert die Lücke zwischen
|
||||
Windows-zentrierten IR-Prozessen und macOS-spezifischen
|
||||
Sicherheitsarchitekturen. Nutzt Tools wie Aftermath für effiziente
|
||||
Datensammlung ohne zeitaufwändige Full-Disk-Images. Besonders wertvoll für
|
||||
Unternehmensumgebungen mit gemischten Betriebssystem-Landschaften.
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
- malware-analysis
|
||||
phases:
|
||||
- data-collection
|
||||
- examination
|
||||
platforms: []
|
||||
related_concepts: null
|
||||
related_software:
|
||||
- Aftermath
|
||||
domain-agnostic-software: null
|
||||
skillLevel: intermediate
|
||||
accessType: null
|
||||
url: >-
|
||||
https://www.sans.org/white-papers/rapid-incident-response-on-macos-actionable-insights-under-hour/
|
||||
projectUrl: null
|
||||
license: null
|
||||
knowledgebase: null
|
||||
tags:
|
||||
- macos
|
||||
- rapid-response
|
||||
- triage
|
||||
- incident-response
|
||||
- aftermath
|
||||
- enterprise
|
||||
- methodology
|
||||
- apple
|
||||
- name: Aftermath
|
||||
icon: 📦
|
||||
- name: Autopsy
|
||||
type: software
|
||||
description: >-
|
||||
Jamf's Open-Source-Tool für die schnelle Sammlung forensischer Artefakte
|
||||
auf macOS-Systemen. Sammelt kritische Daten wie Prozessinformationen,
|
||||
Netzwerkverbindungen, Dateisystem-Metadaten und Systemkonfigurationen ohne
|
||||
Full-Disk-Imaging. Speziell entwickelt für die Rapid-Response-Triage in
|
||||
Enterprise-Umgebungen mit macOS-Geräten. Normalisiert Zeitstempel und
|
||||
erstellt durchsuchbare Ausgabeformate für effiziente Analyse.
|
||||
Die führende Open-Source-Alternative zu kommerziellen Forensik-Suiten mit
|
||||
intuitiver grafischer Oberfläche. Besonders stark in der Timeline-Analyse,
|
||||
Keyword-Suche und dem Carving gelöschter Dateien. Die modulare
|
||||
Plugin-Architektur erlaubt Erweiterungen für spezielle
|
||||
Untersuchungsszenarien. Zwar komplexer als kommerzielle Lösungen, aber
|
||||
dafür vollständig transparent und kostenfrei.
|
||||
skillLevel: intermediate
|
||||
url: https://www.autopsy.com/
|
||||
icon: 📦
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
- malware-analysis
|
||||
- mobile-forensics
|
||||
- cloud-forensics
|
||||
phases:
|
||||
- data-collection
|
||||
- examination
|
||||
platforms:
|
||||
- macOS
|
||||
- analysis
|
||||
tags:
|
||||
- gui
|
||||
- filesystem
|
||||
- timeline-analysis
|
||||
- carving
|
||||
- artifact-extraction
|
||||
- keyword-search
|
||||
- scenario:file_recovery
|
||||
- scenario:browser_history
|
||||
related_concepts:
|
||||
- SQL Query Fundamentals
|
||||
- Hash Functions & Digital Signatures
|
||||
related_software: null
|
||||
domain-agnostic-software: null
|
||||
skillLevel: intermediate
|
||||
platforms:
|
||||
- Windows
|
||||
- Linux
|
||||
accessType: download
|
||||
url: https://github.com/jamf/aftermath/
|
||||
projectUrl: ''
|
||||
license: Apache 2.0
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- macos
|
||||
- incident-response
|
||||
- triage
|
||||
- artifact-collection
|
||||
- rapid-response
|
||||
- jamf
|
||||
- enterprise
|
||||
- commandline
|
||||
- name: Regular Expressions (Regex)
|
||||
icon: 🔤
|
||||
type: concept
|
||||
- name: Volatility 3
|
||||
type: software
|
||||
description: >-
|
||||
Pattern matching language for searching, extracting, and manipulating
|
||||
text. Essential for log analysis, malware signature creation, and data
|
||||
extraction from unstructured sources. Forms the backbone of many forensic
|
||||
tools and custom scripts.
|
||||
domains:
|
||||
- incident-response
|
||||
- malware-analysis
|
||||
- network-forensics
|
||||
- fraud-investigation
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
related_concepts: null
|
||||
related_software: null
|
||||
domain-agnostic-software: null
|
||||
skillLevel: intermediate
|
||||
accessType: null
|
||||
url: https://regexr.com/
|
||||
projectUrl: null
|
||||
license: null
|
||||
knowledgebase: true
|
||||
tags:
|
||||
- pattern-matching
|
||||
- text-processing
|
||||
- log-analysis
|
||||
- string-manipulation
|
||||
- search-algorithms
|
||||
- name: SQL Query Fundamentals
|
||||
icon: 🗃️
|
||||
type: concept
|
||||
description: >-
|
||||
Structured Query Language for database interrogation and analysis.
|
||||
Critical for examining application databases, SQLite artifacts from
|
||||
mobile devices, and browser history databases. Enables complex
|
||||
correlation and filtering of large datasets.
|
||||
domains:
|
||||
- incident-response
|
||||
- mobile-forensics
|
||||
- fraud-investigation
|
||||
- cloud-forensics
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
related_concepts: null
|
||||
related_software: null
|
||||
domain-agnostic-software: null
|
||||
skillLevel: intermediate
|
||||
accessType: null
|
||||
url: https://www.w3schools.com/sql/
|
||||
projectUrl: null
|
||||
license: null
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- database-analysis
|
||||
- query-language
|
||||
- data-correlation
|
||||
- mobile-artifacts
|
||||
- browser-forensics
|
||||
- name: Hash Functions & Digital Signatures
|
||||
icon: 🔐
|
||||
type: concept
|
||||
description: >-
|
||||
Cryptographic principles for data integrity verification and
|
||||
authentication. Fundamental for evidence preservation, malware
|
||||
identification, and establishing chain of custody. Understanding of MD5,
|
||||
SHA, and digital signature validation.
|
||||
Das Universalwerkzeug der Live-Forensik, unverzichtbar für die Analyse von
|
||||
RAM-Dumps. Mit über 100 Plugins extrahiert es Prozesse,
|
||||
Netzwerkverbindungen, Registry-Keys und versteckte Malware aus dem
|
||||
Arbeitsspeicher. Die Python-basierte Architektur macht es flexibel
|
||||
erweiterbar, erfordert aber solide Kommandozeilen-Kenntnisse. Version 3
|
||||
bringt deutliche Performance-Verbesserungen und bessere
|
||||
Formatunterstützung.
|
||||
skillLevel: advanced
|
||||
url: https://www.volatilityfoundation.org/
|
||||
icon: 📦
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
- malware-analysis
|
||||
- cloud-forensics
|
||||
- network-forensics
|
||||
phases:
|
||||
- data-collection
|
||||
- examination
|
||||
platforms: []
|
||||
related_concepts: null
|
||||
related_software: null
|
||||
domain-agnostic-software: null
|
||||
skillLevel: advanced
|
||||
accessType: null
|
||||
url: https://en.wikipedia.org/wiki/Cryptographic_hash_function
|
||||
projectUrl: null
|
||||
license: null
|
||||
knowledgebase: false
|
||||
- analysis
|
||||
scenarios:
|
||||
- scenario:memory_dump
|
||||
tags:
|
||||
- cryptography
|
||||
- data-integrity
|
||||
- evidence-preservation
|
||||
- malware-identification
|
||||
- chain-of-custody
|
||||
- commandline
|
||||
- memory
|
||||
- malware-analysis
|
||||
- artifact-extraction
|
||||
- scripting
|
||||
- process-analysis
|
||||
related_concepts:
|
||||
- Hash Functions & Digital Signatures
|
||||
- Regular Expressions (Regex)
|
||||
platforms:
|
||||
- Windows
|
||||
- Linux
|
||||
- macOS
|
||||
accessType: download
|
||||
license: VSL
|
||||
knowledgebase: false
|
||||
domains:
|
||||
- id: incident-response
|
||||
name: Incident Response & Breach-Untersuchung
|
||||
@@ -212,9 +118,27 @@ domain-agnostic-software:
|
||||
name: Betriebssysteme
|
||||
description: Operating Systems which focus on forensics
|
||||
scenarios:
|
||||
- id: registry
|
||||
icon: 🗃️
|
||||
friendly_name: "Registry-Analyse"
|
||||
- id: memory-forensics
|
||||
- id: scenario:disk_imaging
|
||||
icon: 💽
|
||||
friendly_name: Datenträgerabbild
|
||||
- id: scenario:memory_dump
|
||||
icon: 🧠
|
||||
friendly_name: "Memory-Forensik"
|
||||
friendly_name: RAM-Analyse
|
||||
- id: scenario:file_recovery
|
||||
icon: 🗑️
|
||||
friendly_name: Datenrettung
|
||||
- id: scenario:browser_history
|
||||
icon: 🌍
|
||||
friendly_name: Browser-Spuren
|
||||
- id: scenario:credential_theft
|
||||
icon: 🛑
|
||||
friendly_name: Zugangsdiebstahl
|
||||
- id: scenario:remote_access
|
||||
icon: 📡
|
||||
friendly_name: Fernzugriffe
|
||||
- id: scenario:persistence
|
||||
icon: ♻️
|
||||
friendly_name: Persistenzsuche
|
||||
- id: scenario:windows-registry
|
||||
icon: 📜
|
||||
friendly_name: Registry-Analyse
|
||||
Reference in New Issue
Block a user