TLDR Tech / InfoSec
VanGuard
VanGuard is a single-binary Go-based DFIR toolkit that consolidates triage, threat hunting, memory forensics, disk collection, and Velociraptor lifecycle management for Windows and Linux, with full air-gap support and zero installation required. The toolkit ships 28 pre-built MITRE ATT&CK-mapped use cases, integrates Hayabusa, Chainsaw, Loki, YARA, KAPE, EZ Tools, UAC, WinPMEM, AVML, and Volatility3, and supports remote operations over WinRM, SSH, and PSExec with bounded concurrency. Evidence integrity is built in via dual MD5+SHA256 hashing at collection time, an append-only chain-of-custody record, and HMAC-SHA256 tamper-evident audit logging, with credentials never written to disk or logs.
Read the full story