Digital Forensics

soteria-security/hafnium-ioc

A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865

mandiant/ioc-scanner-cve-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781

mandiant/citrix-ioc-scanner-cve-2023-3519

Bash-based scanner detecting indicators of compromise from CVE-2023-3519 exploitation on Citrix ADC appliances, supporting live and forensic image…

adamrpostjr/cve-2021-27065

Quick One Line Powershell scripts to detect for webshells, possible zips, and logs.

sucuri-labs/cve-2025-57819-ioc-check

This is repository contains a script to check for current IOCs listed in the freepbx forum topic of the CVE-2025-57819

soteria-research/cve-2015-4843-type-confusion-phrack

Demonstrates type confusion and heap overflow exploits for CVE-2015-4843 in Java, with demos for aarch64 and Morello, highlighting CHERI capability…

0vercl0k/cve-2022-21974

PoC for CVE-2022-21974 "Roaming Security Rights Management Services Remote Code Execution Vulnerability"

0vercl0k/cve-2022-21971

PoC for CVE-2022-21971 "Windows Runtime Remote Code Execution Vulnerability"

0vercl0k/cve-2021-32537

PoC for CVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel.

maldev-academy/dumpchromesecrets

Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsing history, and bookmarks

mandiant/threatpursuit-vm

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and…

jamf/cve-2020-1206-poc

CVE-2020-1206 Uninitialized Kernel Memory Read POC

0x0v1/audix

Audix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring

grapl-security/grapl

Graph platform for Detection and Response

yelparchive/osxcollector

A forensic evidence collection & analysis toolkit for OS X

mandiant/silketw

C# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…

dnspy/dnspy

.NET debugger and assembly editor