OSXCollector
OSXCollector is a forensic evidence collection & analysis toolkit for OSX. The collection script runs on a potentially infected machine and outputs a JSON file that describes the target machine. OSXCollector gathers information from plists, SQLite databases, and the local file system. Armed with the forensic collection, an analyst can answer questions like: Is this machine infected? How'd that malware get there? How can I prevent and detect further infection? Yelp automates the analysis of most OSXCollector runs, converting its output into an easily readable and actionable summary of just the suspicious stuff. Check out OSXCollector Output Filters project to learn how to make the most of the automated OSXCollector output analysis. osxcollector.py is a single Python file that runs without any dependencies on a standard OSX machine, making it really easy to run collection on any machine - no fussing with brew, pip, config files, or environment variables. Just copy the single file onto the machine and run it: sudo osxcollector.py is all it takes. $ sudo osxcollector.py Wrote 35394 lines. Output in osx
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A Windows Registry hive extraction library that reads and writes Windows Registry 'hive' binary files.
Easy-to-use live forensics toolbox for Linux endpoints with various capabilities such as process inspection, memory analysis, and YARA scanning.
Analyzing WiFiConfigStore.xml file for digital forensics on Android devices.
A cross-platform registry hive editor for forensic analysis with advanced features like hex viewer and reporting engine.
A reverse engineering framework with a focus on usability and code cleanliness
Powerful tool for searching and hunting through Windows forensic artefacts with support for Sigma detection rules and custom Chainsaw detection rules.
A framework/scripting tool to standardize and simplify the process of scripting favorite Live Acquisition utilities for Incident Responders.
A Mac OS X forensic utility for ensuring correct forensic procedures during disk imaging.
Rekall is a discontinued project that aimed to improve memory analysis methodology but faced challenges due to the nature of in-memory structure and increasing security measures.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.