Back to Portfolio Tool Build

DFIR Triage Tool Case Study

Two-part Bash and Python automation tool that runs all six forensic modules from the Linux breach investigation and produces a tabbed HTML incident report.

 Security Tool  ·  DFIR Automation Bash + Python

Built a Two-Part Automated DFIR Triage Tool That Runs All Six Investigation Modules and Produces a Tabbed HTML Incident Report

Language
Bash 4.0 + Python 3.6+
Modules
6 forensic domains
Output
HTML report, JSON, timeline
Dependencies
Python stdlib only
MITRE Techniques
Mapped per finding
Source
CyberDefenders Linux Breach
View on GitHub
What It Does

Two-part tool built directly from the CyberDefenders Linux Breach Investigation CTF. dfir-triage.sh runs all six forensic modules in sequence: log analysis, memory forensics, network forensics, disk forensics, malware triage, and timeline correlation. Attacker IP discovered in Module 1 is automatically threaded into Modules 2 through 5 so each module hunts the same actor. report.py then reads the JSON findings and timeline and renders a tabbed HTML incident report covering Summary, Findings, Timeline, and MITRE ATT&CK mapping. No external dependencies.

Usage
$ ./dfir-triage.sh -l /logs -m /volatility -n capture.pcap -d disk.dd -w /malware -a <attacker_ip> -c <c2_ip>
$ python3 report.py --input ./output/<timestamp> --title "Incident Report"
Six Forensic Modules
01. Log Analysis

Parses auth.log, apache access/error logs, syslog, kern.log. Extracts attacker IP, brute force count, web shell path, and persistence indicators. Feeds discovered IP downstream.

02. Memory Forensics

Runs Volatility3 pstree and netscan. Flags anomalous parent-child chains, suspicious PIDs, and C2 connections. Matches network sessions to the attacker IP from Module 1.

03. Network Forensics

Uses tshark to count conversations, filter by attacker IP, extract DNS queries, and identify C2 traffic. Reconstructs session data from the supplied PCAP file.

04. Disk Forensics

Mounts disk image read-only, runs strings and foremost, searches for deleted files and attacker artifacts in unallocated space. Reports carved files and suspicious strings.

05. Malware Triage

Static analysis: file type detection, strings extraction for IPs/domains/paths, ELF header inspection, and optional VirusTotal hash lookup. No sandbox required.

06. Timeline Builder

Correlates timestamped events from all five prior modules, sorts chronologically, and writes timeline.txt. report.py renders this as a visual MITRE-mapped incident timeline in HTML.

Bash Python 3 Volatility3 tshark strings foremost grep / awk strace MITRE ATT&CK HTML Report
Why I Built This
  • →After completing the six-part investigation manually, I wanted to codify the methodology so any analyst could run it consistently against a new set of evidence with a single command.
  • →Cross-module correlation (attacker IP flows automatically from Module 1 into Modules 2 through 5) eliminates the manual copy-paste step that causes analysts to miss connections under pressure.
  • →The HTML report output is designed for real-world delivery: tabbed layout, MITRE ATT&CK mapping, and an executive summary that a SOC lead or IR manager can read without touching a terminal.