diff --git a/README.md b/README.md index b80259d..cc7a880 100644 --- a/README.md +++ b/README.md @@ -1017,6 +1017,10 @@ _return-to-libc techniques_ JPCERTCC/LogonTracer Investigate malicious Windows logon by visualizing and analyzing Windows event log + + IllusiveNetworks-Labs/HistoricProcessTree + An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view. + intezer/linux-explorer Easy-to-use live forensics toolbox for Linux endpoints