Tools: gather-and-analyze-data (13)

Extract and decode data from antivirus quarantine files.

Perform a variety of forensics and incident response tasks using this DFIR framework and toolset.

Python library to encode/decode DNS wire-format packets.

Parse Windows Event Trace Log (ETL) files.

Extract IOCs from security report PDFs.

Retrieve and parse whois data for IP addresses.

Query public repositories of malware data (e.g., VirusTotal, HybridAnalysis).

Look up MD5 file hashes in the NIST National Software Reference Library (NSRL).

Query passive DNS databases for DNS data.

Decode and encode date and timestamps.

Search VirusTotal for file hashes.

Submit files to VirusTotal.

Scan files using YARA rules, the next generation of YARA written in Rust.