meta data for this page
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| soc:tools:start [2026/06/10 14:16] – titannet | soc:tools:start [2026/06/10 15:04] (current) – titannet | ||
|---|---|---|---|
| Line 6: | Line 6: | ||
| * [[kibana]] | * [[kibana]] | ||
| * [[splunk]] | * [[splunk]] | ||
| - | |||
| ===== Network ===== | ===== Network ===== | ||
| - | [[wireshark]] | + | * [[wireshark]] |
| Line 17: | Line 16: | ||
| ===== IR ===== | ===== IR ===== | ||
| - | * [[x-ways]] | + | * [[velociraptor]] |
| + | * remote artefact collection and administration | ||
| + | * [[iris]] | ||
| + | * Collaborative Incident Response Platform | ||
| + | * [[x_ways]] | ||
| * [[axiom]] | * [[axiom]] | ||
| - | * [[f-Response]] | + | * [[f_Response]] |
| * [[arsenal_image_mounter]] | * [[arsenal_image_mounter]] | ||
| * [[magnet_ram_capture]] | * [[magnet_ram_capture]] | ||
| Line 28: | Line 31: | ||
| * [[regripper]] | * [[regripper]] | ||
| * [[ghidra]] | * [[ghidra]] | ||
| + | |||
| + | ===== Commandline ===== | ||
| * [[evtwalk]] | * [[evtwalk]] | ||
| * Parse Windows Event Logs | * Parse Windows Event Logs | ||
| - | * [[yaru]] | + | |
| - | * Yet another registry utility | + | |
| - | * [[usp]] | + | |
| - | * USB parser | + | |
| * [[dissect]] | * [[dissect]] | ||
| * Analysis of file systems and images | * Analysis of file systems and images | ||
| * [[timelines] | * [[timelines] | ||
| * tools like [[plaso]], [[log2timeline]], | * tools like [[plaso]], [[log2timeline]], | ||
| + | * [[hayabusa]] | ||
| + | * Parses windows event logs or sysmon/ | ||
| + | |||
| + | |||
| + | ===== Windows GUI ===== | ||
| + | |||
| + | * [[memprocfs]] | ||
| + | |||
| + | * [[wireshark]] | ||
| + | * [[networkminer]] | ||
| + | * [[snort]] | ||
| + | * [[zeek]] | ||
| + | * [[yaru]] | ||
| + | * TZworks, yet another registry utility | ||
| + | * [[usp]] | ||
| + | * TZWorks, USB parser | ||
| + | * [[sysinternals]] | ||
| + | * tcpview, resmon, | ||
| + | |||
| + | |||
| + | ===== Malware Analysis ===== | ||
| + | |||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | |||
| ==== Data Collection ==== | ==== Data Collection ==== | ||
| Line 52: | Line 82: | ||
| + | ==== Active Directory ==== | ||
| + | |||
| + | * [[ping_castle]] | ||