Purple Team Toolkit

A curated toolkit of tools and playbooks for digital forensics, threat hunting, and blue team operations.

---

📌 Table of Contents

• Tools
• Usage
• Installation
• Roadmap
• Contributing

---

🔍 Tools

Memory & Forensics

• Volatility – Memory forensics framework.
• Cyber Triage – Incident response and triage tool.
• Velociraptor – Endpoint visibility and digital forensics platform.
• UAC (Linux Artifact Collector) – Collects forensic artifacts on Linux systems.

Threat Hunting

• THOR – Full-featured scanner for forensic artifacts and IOC detection.
• Velociraptor – Also useful for live threat hunting.

---

🚀 Usage

Clone this repository:

git clone https://github.com/EhsanCreator/purple-toolkit.git
cd purple-toolkit

Follow the instructions below for your platform to set up the tools.

---

🛠️ Installation

Linux

cd scripts
chmod +x install.sh
./install.sh

Installs Python, Git, Volatility3, Velociraptor, and UAC. THOR is commercial and must be downloaded manually.

Windows

# Open PowerShell as Administrator
cd path\to\purple-toolkit\scripts
.\install.ps1

Installs Python, Git, Velociraptor, and Volatility3. THOR must be downloaded manually. UAC is Linux-only.

---

📂 Folder Structure Overview

• docs/playbooks/ – Step-by-step playbooks for memory forensics, log analysis, and endpoint investigation.
• docs/case-studies/ – Example forensic cases demonstrating toolkit usage.
• examples/ – Sample memory dumps, logs, and reports.
• scripts/ – Installation scripts for Linux and Windows.
• tools/ – Configuration files, rules, or helpers for your tools.

---

🤝 Contributing

Contributions are welcome!

1. Fork the repository
2. Create a feature branch (git checkout -b feature/your-feature)
3. Make your changes
4. Commit (git commit -m "Add feature")
5. Push (git push origin feature/your-feature)
6. Open a Pull Request