These are tools discussed Learning Ransomware Response & Recovery by W. Curtis Preston and Dr. Mike Saylor. Browse the list of all tools or get the book.
Inclusion in this directory does not indicate endorsement.
If you see a missing tool, leave a comment!
These specialized tools provide focused capabilities for specific analysis tasks like log parsing, pattern matching, and timeline generation.
- Chainsaw – https://github.com/WithSecureLabs/chainsaw – Windows event log analysis tool
- Hayabusa – https://github.com/Yamato-Security/hayabusa – Timeline generation for Windows logs
- Sigma – https://github.com/SigmaHQ/sigma – Universal signature format for SIEM systems
- YARA – https://github.com/virustotal/yara – Pattern matching for malware detection
- Timeline Explorer – https://ericzimmerman.github.io – Excel-based forensic timeline analysis
- Neo23x0’s YARA Signatures – https://github.com/Neo23x0/signature-base – Pre-built YARA rules repository