Response plans to adapt, rules to deploy, references to keep open and scripts to read before you run them. Free, versioned, and cited down to the step.
Every entry carries a provenance stamp. CONSTRUCTED means it was drafted for this library and any sample events in it are invented, while the techniques, event IDs and sources it cites are real. REAL is reserved for material a person has checked against a real event or a real system.
Full-lifecycle response plans: triggers, roles, containment decisions, eradication, recovery and the review afterwards. The first-hour playbooks tell you what to do now; these are what you adapt into your own runbook before anything happens.
Two responses that have to run at once. One is a race with a bank transfer measured in hours. The other is evicting an operator who is still reading the mailbox, and who survives a password reset unless you remove what they left behind.
The response where the usual instincts are wrong. Speed matters less than lawfulness, the suspect is a colleague with rights, and half of these turn out to be misunderstanding. A plan for investigating quietly, preserving what you would need, and being able to stand behind how you did it.
The whole response rather than the first hour of it: who decides what, how to contain without destroying the evidence you will need, what has to be true before you restore, and the notifications whose clocks started before you noticed.
Sigma packs for endpoint and network telemetry and YARA samples for files and memory. Every rule ships with the false positives it was written expecting, because a rule deployed without them gets switched off in a fortnight.
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
Long DNS labels, scripting-engine user agents at the proxy, executables fetched from a bare IP address, and SMB leaving the network. Written for the log sources most estates already collect and rarely alert on.
Request-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.
Cheat sheets for Windows event logs, memory forensics and timeline building. Each one is a page you keep open, with the defaults that silently hide evidence called out.
A timeline is only as good as your understanding of what each timestamp means. The artifacts that carry time on Windows, what event each one actually records, the zone it is stored in, and the commands to build and cut a super timeline.
What to capture before you touch anything else, how to check the image is usable, and the Volatility 3 plugins grouped by the question they answer, with what each one cannot tell you.
Organised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.
Triage and analysis scripts hosted here in plain text, and the outside tooling worth installing before you need it. Everything hosted is read-only on the target and short enough to read before you run it.
Hashes every file in a collection into a sha256sum-compatible manifest, refuses to overwrite one that exists, and on verification reports changed, missing and new files as the three different findings they are.
One Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.
Other people's tools, chosen because they are free, maintained and do one part of a triage well. What each is for, where it fits, and the tools already on this site that run in your browser.
Normalises ISO times, Unix epochs, Windows FILETIME values and zone-less local times to UTC, keeps each original value beside the conversion so it can be checked, flags anything whose zone it had to assume, and never silently drops a row.
