Cyber EspionageDefensiveGeopoliticsNews

Free Cybersecurity Services And Tools Released by CISA

Staff
742

CISA has collected a list of free cybersecurity tools and services to help companies advance their security capabilities as part of our ongoing objective to minimise cybersecurity risk among U.S. critical infrastructure partners and state, local, tribal, and territory governments. CISA’s cybersecurity services, widely used open source tools, and free tools and services given by private and public sector organisations across the cybersecurity community are all part of this live collection. In the future, CISA will set up a method for companies to submit new free tools and services for inclusion on this list.

The list is not exhaustive and is subject to change as new information becomes available. CISA adds items using neutral principles and criteria, and it has complete and unchallengeable discretion over which items are included. The suitability or usefulness of these services and products for any specific use case is not guaranteed by CISA. Any commercial product or service is not endorsed by CISA. Any mention of specific commercial items, processes, or services, whether by service mark, trademark, manufacturer, or otherwise, does not imply or suggest CISA’s endorsement, recommendation, or favouring of those products, processes, or services.

Some of the tools are mentioned here Below:

Reducing the Likelihood of a Damaging Cyber Incident

ServiceSkill LevelOwnerDescriptionLink
CISA Cybersecurity PublicationsBasicCISACISA provides automatic updates to subscribers via email, RSS feeds, and social media. Subscribe to be notified of CISA publications upon release.https://www.cisa.gov/subscribe-updates-cisa
CISA Vulnerability ScanningBasicCISAThis service evaluates external network presence by executing continuous scans of public, static IPs for accessible services and vulnerabilities. It provides weekly vulnerability reports and ad-hoc alerts. See https://www.cisa.gov/cyber-resource-hub for details.Email: vulnerability@cisa.dhs.gov
CISA Web Application ScanningBasicCISAThis service evaluates known and discovered publicly accessible websites for potential bugs and weak configuration to provide recommendations for mitigating web application security risks. See https://www.cisa.gov/cyber-resource-hub for details.Email: vulnerability@cisa.dhs.gov
CISA Phishing Campaign AssessmentBasicCISAThis service provides an opportunity for determining the potential susceptibility of personnel to phishing attacks. This is a practical exercise intended to support and measure the effectiveness of security awareness training. See https://www.cisa.gov/cyber-resource-hub for details.Email: vulnerability@cisa.dhs.gov
CISA Remote Penetration TestBasicCISAThis test simulates the tactics and techniques of real-world adversaries to identify and validate exploitable pathways. This service is ideal for testing perimeter defenses, the security of externally available applications, and the potential for exploitation of open source information. See https://www.cisa.gov/cyber-resource-hub for details.Email: vulnerability@cisa.dhs.gov
Immunet AntivirusBasicCiscoImmunet is a malware and antivirus protection system for Microsoft Windows that utilizes cloud computing to provide enhanced community-based security.https://www.immunet.com/
Cloudflare Unmetered Distributed Denial of Service ProtectionBasicCloudflareCloudflare DDoS protection secures websites, applications, and entire networks while ensuring the performance of legitimate traffic is not compromised.https://www.cloudflare.com/plans/free/
Cloudflare Universal Secure Socket Layer CertificateBasicCloudflareSSL (Secure Socket Layer) is the standard security technology for establishing an encrypted link between a web server and a browser. Cloudflare allows any internet property to use SSL with the click of a button.https://www.cloudflare.com/plans/free/
Microsoft Defender Application GuardBasicMicrosoftThis capability offers isolated browsing by opening Microsoft Edge in an isolated browsing environment to better protect the device and data from malware.https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview
Controlled folder access/Ransomware protection in WindowsBasicMicrosoftControlled folder access in Windows helps protect against threats like ransomware by protecting folders, files, and memory areas on the device from unauthorized changes by unfriendly applications.https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/controlled-folders
Microsoft Defender AntivirusBasicMicrosoftThis tool is used to protect and detect endpoint threats including file-based and fileless malware. Built into Windows 10 and 11 and in versions of Windows Server.https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows
Cybersecurity Evaluation Tool (CSET) and On-Site Cybersecurity ConsultingBasicCISAThis tool assists organizations in protecting their key national cyber assets. The tool provides users with a systematic and repeatable approach to assessing the security posture of their cyber systems and networks. It includes both high-level and detailed questions related to all industrial control and IT systems.https://github.com/cisagov/cset
CIS Hardware and Software Asset TrackerBasicCenter for Internet SecurityThis tool is designed to help identify devices and applications. The spreadsheet can be used to track hardware, software, and sensitive information.https://www.cisecurity.org/white-papers/cis-hardware-and-software-asset-tracking-spreadsheet/
PGPBasicOpen SourceThis tool encrypts emails with public key cryptography.https://www.openpgp.org/
BitLocker for Microsoft WindowsBasicMicrosoftThis tool encrypts Microsoft Windows systems.https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server
AdBlockBasicOpen SourceThis tool blocks pop-up ads, videos and other unwanted content whilst browsing.https://gcatoolkit.org/tool/adblock/
Quad9 for AndroidBasicOpen SourceThis tool for Android devices is designed to help block users from accessing known sites that have viruses or other malware.https://www.quad9.net/news/blog/quad9-connect-now-available-on-google-play/
Quad9BasicOpen SourceThis tool is designed to prevent computers and devices from connecting to malware or phishing sites.https://quad9.net/
Google Safe BrowsingBasicGoogleThis toolset identifies known phishing and malware across the web and helps notify users and website owners of potential harm. It is integrated into many major products and provides tools to webmasters.https://safebrowsing.google.com
Project ShieldBasicGoogle JigsawProject Shield is a free service that defends news, human rights, and election monitoring sites from DDoS attackshttps://projectshield.withgoogle.com/landing
Google reCAPTCHABasicGooglereCAPTCHA uses an advanced risk analysis engine and adaptive challenges to keep malicious software from engaging in abusive activities on a user’s website.https://www.google.com/recaptcha/about/
Web RiskBasicGoogleWeb Risk API is a User Protection Service from Google Cloud designed to reduce the risk of threats targeting user generated content. Web Risk API lets organizations compare URLs in their environment against a repository of over 1 million unsafe URLs.https://cloud.google.com/web-risk
Google Security Command CenterBasicGoogleThis tool helps users strengthen their security posture by evaluating their security and data attack surface; providing asset inventory and discovery; identifying misconfigurations, vulnerabilities and threats; and helping them mitigate and remediate risks.https://cloud.google.com/security-command-center
Google OSS-FuzzBasicGoogleOSS-Fuzz aims to make common open source software more secure and stable by combining modern fuzzing techniques with scalable, distributed execution.https://google.github.io/oss-fuzz/
SantaBasicOpen SourceSanta is a binary authorization system for macOS.https://santa.dev/
Go Safe WebBasicOpen SourceGo Safe Web is a collection of libraries for writing secure-by-default HTTP servers in Go.https://github.com/google/go-safeweb
Open Source Vulnerabilities (OSV)BasicOpen SourceOSV is a vulnerability database and triage infrastructure for open source projects aimed at helping both open source maintainers and consumers of open source.https://osv.dev/
Open Source InsightsBasicOpen SourceOpen Source Insights is a searchable dependency graph with vulnerability information.https://deps.dev/
AllStarBasicOpen SourceAllStar is a GitHub application for enforcing security policies and permissions.https://github.com/ossf/allstar
Security ScorecardsBasicOpen SourceSecurity Scorecards is a collection of security health metrics for open source, allowing users to evaluate the security practices of an open source package before use. Results available publicly as a Google Cloud Big Query Dataset.https://github.com/ossf/scorecard
TinkBasicOpen SourceTink is a multi-language, cross-platform, open-source library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.https://github.com/google/tink
Google Cybersecurity Action TeamBasicGoogleThis service provides a number of security resources including security blueprints, whitepapers, threat reports, and information regarding recent vulnerabilities.https://cloud.google.com/security/gcat
Tsunami Security ScannerBasicOpen SourceTsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.https://github.com/google/tsunami-security-scanner
OpenDNS HomeBasicCiscoOpenDNS blocks phishing websites that try to steal your identity and login information by pretending to be a legitimate website.https://signup.opendns.com/homefree/
CrowdStrike CRTAdvancedCrowdStrikeCRT is a free community tool designed to help organizations quickly and easily review excessive permissions in their Azure AD environments. CRT helps determine configuration weaknesses and provides advice to mitigate this risk.https://www.crowdstrike.com/resources/community-tools/crt-crowdstrike-reporting-tool-for-azure/
Tenable Nessus EssentialsAdvancedTenableThis free version of a vulnerability assessment solution includes remote and local (authenticated) security checks, a client/server architecture with a web-based interface, and an embedded scripting language for writing your own plugins or understanding existing ones. Limited by default to 16 hosts.https://www.tenable.com/products/nessus/nessus-essentials
Alien Labs Open Threat Exchange (OTX) Endpoint SecurityAdvancedAT&T CybersecurityThis tool leverages data from Alien Labs OTX to help identify if endpoints have been compromised in major cyberattacks. Provides quick visibility into threats on all endpoints by scanning IOCs using OTX.https://cybersecurity.att.com/open-threat-exchange
Alien Labs Open Threat Exchange (OTX)AdvancedAT&T CybersecurityOTX provides open access to a global community of threat researchers and security professionals. It delivers community-generated threat data, enables collaborative research, and automates the process of updating security infrastructure with threat data from any source. OTX enables anyone in the security community to actively discuss, research, validate, and share the latest threat data, trends, and techniques.https://cybersecurity.att.com/open-threat-exchange
ClamAVAdvancedCiscoClamAV is an open-source (general public license [GPL]) antivirus engine used in a variety of situations, including email and web scanning, and endpoint security. It provides many utilities for users, including a flexible and scalable multi-threaded daemon, a command-line scanner, and an advanced tool for automatic database updates.http://www.clamav.net/
Kali Linux Penetration Testing PlatformAdvancedKali Linux ProjectKali Linux contains several hundred tools targeted toward various information security tasks, such as penetration testing, security research, computer forensics, and reverse engineering.https://www.kali.org/
Cloudflare Zero Trust ServicesAdvancedCloudflareCloudflare Zero Trust Services are essential security controls to keep employees and apps protected online across 3 network locations and up to 50 users. Services include: Zero Trust Network Access; Secure Web Gateway, Private Routing to IP/Hosts; HTTP/S Inspection and Filters; Network Firewall as a Service; DNS Resolution and Filters; and Cloud Access Security Broker.https://www.cloudflare.com/plans/free/
Microsoft Sysinternals Security UtilitiesAdvancedMicrosoftSysinternals Security Utilities are free, downloadable tools for diagnosing, troubleshooting, and deeply understanding the Windows platform.https://docs.microsoft.com/en-us/sysinternals/downloads/security-utilities
Memory integrityAdvancedMicrosoftMemory integrity in Windows—also known as Hypervisor-protected code integrity (HVCI)—is a Windows security feature that makes it difficult for malicious programs to use low-level drivers to hijack computers.https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity
RiskIQ CommunityAdvancedMicrosoftThe RiskIQ community offers free access to internet intelligence, including thousands of OSINT articles and artifacts. Community users can investigate threats by pivoting through attacker infrastructure data, understand what digital assets are internet-exposed, and map and monitor their external attack surface.https://community.riskiq.com/home
IBM X-Force ExchangeAdvancedIBMIBM X-Force Exchange is a cloud-based threat intelligence platform that allows users to consume, share, and act on threat intelligence. It enables users to conduct rapid research of the latest global security threats, aggregate actionable intelligence, consult with experts, and collaborate with peers.https://www.ibm.com/products/xforce-exchange
Mandiant Attack Surface ManagementAdvancedMandiantThis early warning system for information security allows you to: create comprehensive visibility through graph-based mapping; know when assets change to stay ahead of the threat; and empower security operations to mitigate real-world threats.https://www.mandiant.com/advantage/attack-surface-management/get-started
Mandiant Threat IntelligenceAdvancedMandiantFree access to the Mandiant Threat Intelligence Portal helps users understand recent security trends, proactively hunt threat actors, and prioritize response activities.https://www.mandiant.com/advantage/threat-intelligence/free-version
Splunk Synthetic Adversarial Log Objects (SALO)AdvancedSplunkSALO is a framework for generating synthetic log events without the need for infrastructure or actions to initiate the event that causes a log event.https://github.com/splunk/salo
Splunk Attack Detection Collector (ADC)AdvancedSplunkThis tool simplifies the process of collecting MITRE ATT&CK® techniques from blogs or PDFs and mapping ATT&CK TTPs to Splunk detection content.https://github.com/splunk/attack-detections-collector
Splunk Attack RangeAdvancedSplunkThis tool enables simulated attacks in a repeatable cloud-enabled (or on-premises) lab with a focus on Atomic Red Team integration.https://github.com/splunk/attack_range
Splunk TrainingAdvancedSplunkSplunk Training is a free, hosted platform for on-demand training with hands-on practice addressing specific attacks and realistic scenarios.https://bots.splunk.com
VMware Carbon Black User ExchangeAdvancedVMwareCarbon Black User Exchange provides access to real-time threat research data shared by a global community of security professionals.https://community.carbonblack.com/
Carbon Black TAU Excel 4 Macro AnalysisAdvancedVMwareThis tool tests endpoint security solutions against Excel 4.0 macro techniques.https://github.com/carbonblack/excel4-tests
Paros ProxyAdvancedOpen SourceThis Java-based tool is used to find vulnerabilities in web applications. It includes a web traffic recorder, web spider, hash calculator, and a scanner for testing common web application attacks, such as SQL injection and cross-site scripting.https://www.parosproxy.org/
Cyber Security Tools by SANS InstructorsAdvancedSANSThis website includes links to an array of open-source tools built by cybersecurity instructors.https://www.sans.org/tools/
Windows Management Instrumentation Command-lineAdvancedMicrosoftThe WMI command-line (WMIC) utility provides a command-line interface for Windows Management Instrumentation (WMI). WMIC is compatible with existing shells and utility commands. https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic
Let’s EncryptAdvancedOpen SourceThis tool provides a free digital certificate to enable HTTPS (SSL/TLS) for websites.https://letsencrypt.org/getting-started/
HpingAdvancedOpen SourceThis tool assembles and sends custom ICMP, UDP, or TCP packets and then displays any replies. It can be useful for performing security assessments.http://www.hping.org/
AircrackAdvancedOpen SourceAircrack is a suite of tools for testing the strength of passwords used for wireless networks.https://www.aircrack-ng.org/
NiktoAdvancedOpen SourceNikto is an open source (GPL) web server scanner that performs vulnerability scanning against web servers for multiple items, including dangerous files and programs. Nitko checks for outdated versions of web server software. It also checks for server configuration errors and any possible vulnerabilities they might have introduced.https://cirt.net/nikto2
w3afAdvancedOpen SourceW3af is a flexible framework for finding and exploiting web application vulnerabilities, featuring dozens of web assessment and exploitation plugins.http://w3af.org/
VMware Fusion PlayerAdvancedVMwareThis tool allows Mac users to run Windows, Linux, containers, Kubernetes, and more in virtual machines without rebooting.https://customerconnect.vmware.com/web/vmware/evalcenter?p=fusion-player-personal
Secureworks PhishInSuitsAdvancedSecureworksThe PhishInSuits (pis.py) tool conducts security assessments and tests control frameworks against scenarios, such as BEC attacks. It combines this variation of illicit consent attacks with SMS-based phishing to emulate BEC campaigns and includes automated data-exfiltration capabilities.https://github.com/secureworks/PhishInSuits
Secureworks WhiskeySAMLAdvancedSecureworksThe WhiskeySAML tool automates the remote extraction of an ADFS signing certificate. WhiskeySAML then uses this signing certificate to launch a Golden SAML attack and impersonate any user within the target organization.https://github.com/secureworks/whiskeysamlandfriends
CollabfiltratorAdvancedSecureworksThis tool is designed to exfiltrate blind remote code execution output over DNS via Burp Collaborator.https://github.com/0xC01DF00D/Collabfiltrator
O365SprayAdvancedSecureworksThis tool is a username enumeration and password spraying tool aimed at Microsoft Office 365.https://github.com/0xZDH/o365spray
TachyonAdvancedSecureworksTachyon is a rapid web application security reconnaissance tool. It is designed to crawl a web application and look for leftover or non-indexed files with the addition of reporting pages or scripts leaking internal data (a.k.a “blind” crawling). It is used from the command line and targeted at a specific domain. Tachyon uses an internal database to construct these blind queries swiftly.https://github.com/delvelabs/tachyon
Vane2AdvancedSecureworksVane2 is a WordPress site vulnerability scanner. It is meant to be targeted at WordPress websites and identifies the corresponding WordPress version as well as its installed plugins in order to report known vulnerabilities on each.https://github.com/delvelabs/vane2
BateaAdvancedSecureworksBatea is a practical application of machine learning for pentesting and network reconnaissance. It consumes map reports and uses a context-driven network device ranking framework based on the anomaly detection family of machine learning algorithms. The goal of Batea is to allow security teams to automatically filter interesting network assets in large networks using nmap scan reports.https://github.com/delvelabs/batea
CheckovAdvancedPalo Alto NetworksThis tool scans Infrastructure as Code (IaC), container images, open-source packages, and pipeline configuration for security errors. With hundreds of built-in policies, Checkov surfaces misconfigurations and vulnerabilities in code across developer tools (CLI, IDE) and workflows (CI/CD pipelines).https://github.com/bridgecrewio/checkov
Palo Alto Networks Unit 42- Actionable Threat Objects and Mitigations (ATOMs)AdvancedPalo Alto NetworksATOMs is a free repository of observed behaviors of several common threat adversaries, mapped to the MITRE ATT&CK framework. ATOMs can be filtered by targeted sector, region, or malware used for ease of information sharing and deployment of recommended security mitigations.https://unit42.paloaltonetworks.com/atoms/ ;
Google ClusterFuzzAdvancedGoogleClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. It is also the fuzzing backend for Google OSS-Fuzz. ClusterFuzz Lite is simple CI-integrated fuzzing based on ClusterFuzz.https://google.github.io/clusterfuzz/

Take Steps to Quickly Detect a Potential Intrusion

ServiceSkill LevelOwnerDescriptionLink
Microsoft Defender AntivirusBasicMicrosoftThis tool protects and detects endpoint threats, including file-based and fileless malware. Built into Windows 10 and 11 and in versions of Windows Server.https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows
Microsoft Safety ScannerBasicMicrosoftMicrosoft Safety Scanner is a scan tool designed to find and remove malware from Windows computers. It can run scans to find malware and try to reverse changes made by identified threats.https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download
Windows Malicious Software Removal toolBasicMicrosoftThis tool is released by Microsoft on a monthly cadence as part of Windows Update or as a standalone tool. It can be used to find and remove specific prevalent threats and reverse the changes they have made.https://support.microsoft.com/en-us/topic/remove-specific-prevalent-malware-with-windows-malicious-software-removal-tool-kb890830-ba51b71f-39cd-cdec-73eb-61979b0661e0
MSTICpyBasicMicrosoftMSTICPy is a SIEM-agnostic package of Python tools for security analysts to assist in investigations and threat hunting. It is primarily designed for use in Jupyter notebooks.https://msticpy.readthedocs.io/en/latest/
Google Safe BrowsingBasicGoogleThis service identifies known phishing and malware across the web and helps notify users and website owners of potential harm. It is integrated into many major products and provides tools to webmasters.https://safebrowsing.google.com
Mandiant Red Team and Investigative ToolsAdvancedMandiantThese tools are designed to confirm and investigate suspected security compromises.https://github.com/Mandiant
Splunk Connect for SyslogAdvancedSplunkThis tool is used for getting syslog-based data into Splunk, including functions for data filtering and parsing.https://splunkbase.splunk.com/app/4740/#/overview
Enterprise Log Search and Archive (ELSA)AdvancedOpen sourceEnterprise Log Search and Archive (ELSA) is a three-tier log receiver, archiver, indexer, and web front end for incoming syslog. https://github.com/mcholste/elsa
Mandiant Azure AD InvestigatorAdvancedMandiantThis repository contains a PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity. Some indicators are “high-fidelity” indicators of compromise; other artifacts are so-called “dual-use” artifacts. Dual-use artifacts may be related to threat actor activity, but also may be related to legitimate functionality.https://github.com/mandiant/Mandiant-Azure-AD-Investigator
VirusTotalAdvancedGoogleVirusTotal inspects items with over 70 antivirus scanners and URL/domain blocklisting services, in addition to a variety of tools, to extract signals from the studied content. Users can select a file from a computer via the browser and send it to VirusTotal. Submissions may be scripted in any programming language using the HTTP-based public API.https://support.virustotal.com/hc/en-us/articles/115002126889-How-it-works
NetfilterAdvancedOpen SourceNetfilter is a packet filter implemented in the standard Linux kernel. The user space iptables tool is used for configuration. It supports packet filtering (stateless or stateful), many kinds of network address and port translation (NAT/NAPT), and multiple API layers for third-party extensions. It includes many different modules for handling unruly protocols, such as FTP.https://www.netfilter.org/
WiresharkAdvancedOpen SourceWireshark is an open-source multi-platform network protocol analyzer that allows users to examine data from a live network or from a capture file on disk. The tool can interactively browse capture data, delving down into just the level of packet detail needed. Wireshark has multiple features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session. It also supports hundreds of protocols and media types.https://www.wireshark.org/
EttercapAdvancedOpen SourceEttercap is a suite for adversary-in-the-middle attacks on LAN that includes sniffing of live connections, content filtering on the fly, and many other features. It supports active and passive dissection of many protocols (including ciphered protocols) and includes many features for network and host analysis.http://ettercap.sourceforge.net/
KismetAdvancedOpen SourceKismet is a console (ncurses)-based 802.11 layer-2 wireless network detector, sniffer, and intrusion detection system. It identifies networks by passively sniffing and can decloak hidden (non-beaconing) networks if they are in use. It can automatically detect network IP blocks by sniffing TCP, UDP, ARP, and DHCP packets, log traffic in Wireshark/tcpdump compatible format, and even plot detected networks and estimated ranges on downloaded maps.https://www.kismetwireless.net/
SnortAdvancedCiscoThis network intrusion detection and prevention system conducts traffic analysis and packet logging on IP networks. Through protocol analysis, content searching, and various pre-processors, Snort detects thousands of worms, vulnerability exploit attempts, port scans, and other suspicious behavior. Snort uses a flexible rule-based language to describe traffic that it should collect or pass, and a modular detection engine. The related free Basic Analysis and Security Engine (BASE) is a web interface for analyzing Snort alerts.https://www.snort.org/
sqlmapAdvancedOpen Sourcesqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of back-end database servers. It comes with a broad range of features, from database fingerprinting to fetching data from the DB and accessing the underlying file system and executing OS commands via out-of-band connections.http://sqlmap.org/
RITAAdvancedOpen SourceReal Intelligence Threat Analytics (R-I-T-A) is an open-source framework for detecting command and control communication through network traffic analysis. The RITA framework ingests Zeek logs or PCAPs converted to Zeek logs for analysis.https://www.activecountermeasures.com/free-tools/rita/
Secureworks DaltonAdvancedSecureworksDalton is a system that allows a user to run network packet captures against a network sensor of their choice using defined rulesets and/or bespoke rules. Dalton covers Snort/Suricata/Zeek analysis in one system.https://github.com/secureworks/dalton

Ensure That The Organization is Prepared to Respond if an Intrusion Occurs

ServiceSkill LevelOwnerDescriptionLink
GRR Rapid ResponseBasicGoogleGRR Rapid Response is an incident response framework focused on remote live forensics. The goal of GRR is to support forensics and investigations in a fast, scalable manner to allow analysts to quickly triage attacks and perform analysis remotely.https://grr-doc.readthedocs.io
Microsoft PsExecAdvancedMicrosoftPsExec is a lightweight telnet replacement that lets users execute processes on other systems (complete with full interactivity for console applications) without having to manually install client software. PsExec’s uses include launching interactive command-prompts on remote systems and remote-enabling tools such as IpConfig that otherwise do not have the ability to show information about remote systems.https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
VMware Workstation PlayerAdvancedVMwareThis tool runs a single virtual machine on a Windows or Linux PC. It can be used when setting up an environment to analyze malware.https://www.vmware.com/products/workstation-player/workstation-player-evaluation.html
VMware ESXi – FreeAdvancedVMwareThis tool can be used when setting up an environment to analyze malware. It is a bare-metal hypervisor that installs directly onto a physical server, providing direct access to, and control of, underlying resources. It can be used to effectively partition hardware to consolidate applications.https://www.vmware.com/products/esxi-and-esx.html
dTimeWolfAdvancedGoogledTimeWolf is an open-source framework for orchestrating forensic collection, processing, and data export.https://dftimewolf.readthedocs.io
TurbiniaAdvancedGoogleTurbinia is an open-source framework for deploying, managing, and running distributed forensic workloads.https://turbinia.readthedocs.io
TimesketchAdvancedOpen SourceTimesketch is an open-source tool for collaborative forensic timeline analysis. Using sketches, users and their collaborators can easily organize timelines and analyze them all at the same time.https://timesketch.org/

Maximize the Organization’s Resilience to a Destructive Cyber Incident

ServiceSkill LevelOwnerDescriptionLink
Windows Auto-BackupBasicMicrosoftThis tool sets up automatic backups of Windows 10 and 11 operating systems.https://support.microsoft.com/en-us/windows/backup-and-restore-in-windows-352091d2-bb9d-3ea3-ed18-52ef2b88cbef
Google Backup & SyncBasicGoogleThis tool backs up files on Windows or Mac computers. Note: it does not allow users to restore their system; it only saves copies of files.https://support.google.com/drive/answer/7638428
Microsoft Threat Modeling ToolAdvancedMicrosoftThis tool is designed to make threat modeling easier for developers through a standard notation for visualizing system components, data flows, and security boundaries.https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling
Microsoft SecCon FrameworkAdvancedMicrosoftThis framework is designed to help prioritize endpoint hardening recommendations.https://github.com/microsoft/SecCon-Framework

You May Also Like

Next-gen missile data, Hacked in Japan report says

Staff

Threat actors gained access to the personal data of tens of thousands of Revolut customers as a result of a cyberattack

Staff

A Successful Threat-Hunting Program’s Foundation

Staff

Leave a Reply

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.