Library

If you are new, read these before anything with a vendor logo on it.

• Computer Security Incident Handling Guide (SP 800-61)public domain

  NIST · The reference every IR process is eventually a variation of. Dry, and worth it.

• Guide to Integrating Forensic Techniques into Incident Response (SP 800-86)public domain

  NIST · Where forensics meets IR, including the order of volatility. Still the clearest treatment.

• The ATT&CK framework itselffree to read

  MITRE · Read technique pages, not the matrix. See the primer here first if the grid put you off.

• D3FENDfree to read

  MITRE · ATT&CK describes what an attacker does. This describes what a defence does, in the same structured way, and the two map onto each other.

• Cyber Analytics Repositoryfree to read

  MITRE · Detection analytics tied to techniques, with the data model each one needs. Useful for working out what you cannot detect yet and why.

• CVSS specificationfree to read

  FIRST · Read the specification rather than trusting the number. Knowing what the vector string actually encodes is what stops a 9.8 that cannot reach you setting your week on fire.

Primary sources. Everything else is commentary on these.

• Known Exploited Vulnerabilities cataloguepublic domain

  CISA · What is being exploited right now, per the US government. Feeds the wire on this site.

• Cybersecurity advisoriespublic domain

  CISA · Joint advisories often carry the fullest public technical detail on a campaign.

• National Vulnerability Databasepublic domain

  NIST · The canonical CVE record. Slower than vendor disclosure and more complete.

All open source. The labs here assume some of these.

• Sysmonfree to read

  Microsoft Sysinternals · Turns Windows from opaque to observable. The single highest-value thing to deploy.

• Atomic Red Teamopen source

  Red Canary · Small tests mapped to ATT&CK, each with a cleanup command. The labs here use it.

• Sigmaopen source

  SigmaHQ · Detection rules in a format that converts to your SIEM, plus a large public ruleset.

• Velociraptoropen source

  Rapid7 · Endpoint visibility and hunting at scale, free, and genuinely used in real engagements.

• Eric Zimmerman’s toolsfree to read

  Eric Zimmerman · The Windows forensics toolset: MFTECmd, PECmd, EvtxECmd, RECmd and the rest. Most Windows artifact work on this site assumes one of these.

• Plasoopen source

  log2timeline · Super timelining across dozens of artifact types. Slow, thorough, and the honest way to build a timeline you did not hand-pick.

• Volatility 3open source

  Volatility Foundation · Memory analysis. Pairs with the memory acquisition sheet: acquiring is the urgent half, this is the other one.

• YARAopen source

  VirusTotal · Pattern matching for files and memory. Read the documentation before writing rules; most bad YARA is bad because of how it was written, not what it looked for.

• LOLBASopen source

  LOLBAS Project · Signed Windows binaries that can be made to do something else. The reference for why a legitimate executable in an alert is not automatically reassuring.

• GTFOBinsopen source

  GTFOBins · The same idea on Unix: standard binaries that break out of restricted shells or escalate. Worth reading before you decide a sudo rule is narrow.

• LOLDriversopen source

  Magnus Stubman and contributors · Vulnerable and malicious signed drivers, which is how EDR gets turned off from kernel space. Check your blocklist against it.

• Untitled Goose Toolopen source

  CISA · Collection for Microsoft cloud tenants. Written for exactly the scoping problem the cloud playbooks here describe.

• Elastic detection rulesopen source

  Elastic · A second public rulebase to read alongside Sigma. Its false-positive notes are frequently better filled in.

Real telemetry to investigate, published for training.

• Malware traffic analysisfree to read

  Brad Duncan · Years of PCAPs with exercises and answers. The standard corpus for network forensics.

• Security Datasetsopen source

  Open Threat Research · Pre-recorded attack telemetry as JSON, mapped to techniques. No lab build required.

• EVTX attack samplesopen source

  sbousseaden · Windows event logs, one set per technique. Excellent for practising log analysis.

• Digital Corporafree to read

  Simson Garfinkel and contributors · Disk images, memory captures and scenario data built for teaching, with the provenance documented. The closest thing to a standard corpus for host forensics.

• Honeynet Project challengesfree to read

  The Honeynet Project · Forensic challenges with published solutions going back years. Old ones are still worth working; the artifacts have not moved much.

• CyberDefendersfree to read

  CyberDefenders · Blue team exercises against real captures. A free tier exists and is enough to be useful.

Published incident analysis of the standard worth aiming at.

• The DFIR Reportfree to read

  The DFIR Report · Full intrusion write-ups with timelines and detections. The benchmark for this format.

• Krebs on Securityfree to read

  Brian Krebs · Investigative journalism rather than technical analysis, and better than most of both.

• This Week in 4n6free to read

  Phill Moore · A weekly round-up of DFIR research, tooling releases and write-ups. The single most efficient way to keep up without reading everything.

• SANS posters and cheat sheetsfree to read

  SANS Institute · Free reference posters on Windows forensics, memory and network analysis. Marketing for their courses, and genuinely useful regardless.

• Awesome incident responseopen source

  Meir Wahnon and contributors · A maintained index of IR tooling and reading. Start here when you need a category of tool rather than a specific one.