andrewrathbun Goto Github PK

followers: 433.0 following: 212.0 repos: 205.0 gists: 3.0

Name: Andrew Rathbun

Type: User

Bio: DFIR @ Unit 42, Admin of the Digital Forensics Discord Server, AboutDFIR.com Contributor, USMC Veteran, Former LE.

Twitter: bunsofwrath12

Location: Michigan

Blog: https://aboutdfir.com/

Welcome to my GitHub Profile!

Current Events

🌱 I’m currently learning C# and PowerShell
👯 I’m looking to collaborate on anything related to DFIR
🤔 I’m looking for help with KAPE Targets/Modules, EvtxECmd Maps, SQLECmd Maps, RECmd Batch Files, Registry Explorer Bookmarks, Registry Explorer Plugins, and Timeline Explorer Plugins

Notable GitHub Repositories

Check out my repositories as I have a lot going on all the time!

My most actively maintained projects can be found here.

Forked/Updated DFIR Tools

I enjoy finding abandoned DFIR tools/projects on GitHub and performing basic updates to keep them relevant and useful to the DFIR community. Check out all the tools I've forked and updated (to varying degrees) here. If you have any ideas of tools or scripts that are long overdue for a tuneup, please let me know!

Projects That Need Updating

If you think the Forked/Updated DFIR Tools list is cool, here is a list of tool repositories that may be transferred to that list someday! Think of this list as a to-do list for me to add more tools to the Forked/Updated DFIR Tools list. Check out my Projects That Need Updating list here.

Side Projects

AboutDFIR

I have been a Contributor to AboutDFIR since late 2019. Be sure to check out the best DFIR resource on the planet! Let us know if you have any suggestions via the Site Feedback Form!

Digital Forensics Discord Server

Join the Digital Forensics Discord Server! Check out my beginner's guide here! Also, check out the Digital Forensics Discord Server's GitHub Organization here where there's lots of cool ongoing projects!

Books

The Hitchhiker's Guide to DFIR: Experiences From Beginners and Experts

The Digital Forensics Discord Server produced a crowdsourced book on August 15, 2022. Check it out here!

EZ Tools Manuals

Eric Zimmerman and I co-authored and published the EZ Tools Manuals on Leanpub! Check it out here!

Binary Foray

Eric Zimmerman's posts from his Binary Foray blog are now in PDF and EPUB format. Check it out here!

Andrew Rathbun's Projects

sighunter

A C# (.NET 6) tool to compare the file signature of files recursively and inform the user of matches and mismatches

sigma

Generic Signature Format for SIEM Systems

silketw

slides

Misc Threat Hunting Resources

sof-elk

Configuration files for the SOF-ELK VM, used in SANS FOR572

spectre.console

A .NET library that makes it easier to create beautiful console applications.

sqlecmd

This repository serves as a place for community created SQLECmd Maps for use with SQLECmd.

srum

sum

thehitchhikersguidetodfirexperiencesfrombeginnersandexperts

The official repo for a project involving a crowdsourced DFIR book. The main purpose of this book is to give anyone interested an opportunity to write a chapter of a book to get their name out there, get a publication on their resume with an actual ISBN number, and ideally lower the bar for people to contribute something back to the DFIR Community. Want to write a chapter? Let me know and let's make it happen!

thor-manual

THOR Scanner User Manual

threathunt

ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.

timeapp

Simple time and public IP app, useful for recording the screen while interacting with a computer for later corroboration of artifacts against time

timelineexplorersettings

A public repo to host and maintain my settings file for Timeline Explorer

tiny-powershell-projects

Learning PowerShell through test-driven development of games and puzzles

tlefileplugins

Plugins for parsing CSV files in Timeline Explorer. This project allows for anyone to add more supported files (i,e. they get a Line #/tag column, layout support, searching, etc.)

trawler

usb-detector

Blue team security tool to help detect physical attacks using USB devices.

usb-explorer

A tool that reads data stored under USBSTOR key in the system registry hive, representing information about connected USB storage devices

usbdevices

Get USB Devices from Registry hives

vanillawindowsreference

A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update. Use these CSVs to create your own known good hash sets!

vanillawindowsregistryhives

A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update.