ToolCONSTRUCTED
The analyst's toolbox: what to have installed before you need it
Other people's tools, chosen because they are free, maintained and do one part of a triage well. What each is for, where it fits, and the tools already on this site that run in your browser.
version 1.0checked 2026-09-21windows · linux · macos1 min read
Hosted here
Small, readable, and with no dependencies beyond what the platform ships:
| Tool | For |
|---|---|
| Collect-Triage.ps1 | Read-only Windows triage collection, in order of volatility |
| linux-triage.sh | The Linux counterpart |
| hash_manifest.py | Write and verify a SHA-256 manifest for a collection |
| timeline_merge.py | Merge CSV exports into one UTC timeline |
| Browser tools | Timestamp conversion, defanging, hash identification and base64, all client-side |
| Evidence-gap checker | What to collect for a given hypothesis, volatile sources first |
Why a list at all
NIST SP 800-86 and SP 800-61 both make the same unglamorous point: the tooling has to exist, be tested and be familiar before the incident. The first time you run a memory acquisition tool should not be on the one host that matters.
So this is a short list on purpose. For each, install it, run it against a test machine, and keep the version you tested. A toolkit of thirty tools nobody has run is worth less than six that somebody has.
Before you download anything mid-incident
- Take tools from the project's own repository or site, over HTTPS, and check the release signature or hash where one is published.
- Keep an offline copy of your toolkit. The incident that needs it may be the one that takes the internet connection away.
- Do not install analysis tools on the host under investigation. Collect there, analyse elsewhere.
Everything linked below is somebody else's work, listed because it is good. Security Artifacts has no relationship with any of the projects.
other people’s tools worth having
MFTECmd, EvtxECmd, PECmd, RECmd, AmcacheParser and Timeline Explorer. The fastest route from a Windows triage collection to CSVs you can sort.
Endpoint collection and hunting at fleet scale. Also builds an offline collector: one executable you hand to somebody on site.
Memory analysis. Pair it with the memory forensics cheat sheet in this library.
Mounts a memory image as a file system, so processes, modules and the registry can be browsed and scanned with ordinary tools.
Linux memory acquisition as a single static binary, with no kernel module to build on the target.
Super timelines from an image or a collection. Slow and thorough. Run it overnight.
Runs Sigma-based detections across a folder of EVTX files and produces a timeline of hits. The quickest first pass over collected Windows logs.
Search and hunt through EVTX, MFT and other artifacts with Sigma and its own rules. Overlaps with Hayabusa; keep whichever your team reads faster.
fls, icat, mactime and the rest: file system analysis from the command line, on any image format.
Converts Sigma rules, including the packs in this library, into queries for your SIEM.
The maintained rewrite of YARA. Runs the rules in this library unchanged.
Sysmon for telemetry, Autoruns for persistence, Process Explorer and ProcDump for live triage. From Microsoft, signed, and usually already allowed.
Decoding and data manipulation in the browser. It runs client-side, and it can be downloaded and opened from disk so that nothing leaves the machine.