#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
fireeye/pywintracePython ctypes wrapper for Event Tracing for Windows (ETW) enabling session control, event capture, and custom callbacks for security monitoring and…
tzwlhack/cve-2021-21017Proof-of-concept exploit for CVE-2021-21017, an Adobe Reader type confusion leading to out-of-bounds read and heap overflow, with technical analysis…
parrotsec/mimikatzTool for extracting Windows credentials (passwords, hashes, Kerberos tickets) from memory and performing pass-the-hash, pass-the-ticket, and golden…
glmcdona/process-dumpWindows tool for dumping malware PE files from memory back to disk for analysis.
letsdefend/awesome-soc-analystUseful resources for SOC Analyst and SOC Analyst candidates.
dump-guy/malware-analysis-and-reverse-engineeringSome of my publicly available Malware analysis and Reverse engineering.
apr4h/cobaltstrikescanScan files or process memory for CobaltStrike beacons and parse their configuration
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
theflink/hunt-sleeping-beaconsCallstack scanner that identifies IOCs of unpacked or injected C2 agents by analyzing thread idle behavior, unbacked memory, module stomping, APCs,…
mthcht/threathunting-keywordsAwesome list of keywords and artifacts for Threat Hunting sessions
vdohney/keepass-password-dumperOriginal PoC for CVE-2023-32784
rek7/mxtractmXtract - Memory Extractor & Analyzer
pedramamini/iocextractDefanged Indicator of Compromise (IOC) Extractor.
jpcertcc/malconfscanVolatility plugin for extracts configuration data of known malware
accentusoft/linkscope_clientRepository for the LinkScope Client software.
tonyphipps/meerkatA collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
felixweyne/imaginaryc2Imaginary C2 is a python tool which aims to help in the behavioral (network) analysis of malware. Imaginary C2 hosts a HTTP server which captures…
