forensicnomicon 0.3.1

The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

use crate::threat_intel::profile::MalwareProfile;

mod azazel;
mod bdvl;
mod beurk;
mod diamorphine;
mod father;
mod jynx;
mod ld_preload_generic;
mod libprocesshider;
mod lkm_generic;
mod medusa;
mod necro;
mod prism;
mod reptile;
mod syslogk;
mod umbreon;
mod xmrig;

pub use azazel::AZAZEL;
pub use bdvl::BDVL;
pub use beurk::BEURK;
pub use diamorphine::DIAMORPHINE;
pub use father::FATHER;
pub use jynx::JYNX;
pub use ld_preload_generic::LD_PRELOAD_GENERIC;
pub use libprocesshider::LIB_PROCESS_HIDER;
pub use lkm_generic::LKM_GENERIC;
pub use medusa::MEDUSA;
pub use necro::NECRO;
pub use prism::PRISM;
pub use reptile::REPTILE;
pub use syslogk::SYSLOGK;
pub use umbreon::UMBREON;
pub use xmrig::XMRIG;

pub const ALL_PROFILES: &[&MalwareProfile] = &[
    &FATHER,
    &JYNX,
    &AZAZEL,
    &BDVL,
    &LIB_PROCESS_HIDER,
    &XMRIG,
    &LKM_GENERIC,
    &LD_PRELOAD_GENERIC,
    &UMBREON,
    &REPTILE,
    &DIAMORPHINE,
    &NECRO,
    &MEDUSA,
    &SYSLOGK,
    &BEURK,
    &PRISM,
];