Digital Forensics

gabriellandau/edrsandblast-godfault

EDRSandblast-GodFault

daddycocoaman/dumpscan

Finding secrets in kernel and user memory

deepfence/packetstreamer

⭐ ⭐ Distributed tcpdump for cloud native environments ⭐ ⭐

cado-security/rip_raw

Rip Raw is a small tool to analyse the memory of compromised Linux systems.

mandiant/mandiant-azure-ad-investigator

Read-only PowerShell module for detecting UNC2452 and other threat actor artifacts in Azure AD, auditing federated domains, service principals,…

hluwa/frida-dexdump

A frida tool to dump dex in memory to support security engineers analyzing malware.

itm4n/ppldump

Dump the memory of a PPL with a userland exploit

labcif/fama

Forensic Analysis for Mobile Apps (FAMA) -- module for the Autopsy Forensic Browser

blackberry/pe_tree

Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump…

ivan-sincek/invoker

Penetration testing utility and antivirus assessment tool.

anttikurittu/kirjuri

Kirjuri is a web application for managing cases and physical forensic evidence items.

snovvcrash/usbrip

Tracking history of USB events on GNU/Linux

mozilla/mig

Distributed & real time digital forensics at the speed of the cloud

google/stenographer

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those…

certcc/keyfinder

A tool for finding and analyzing private (and public) key files, including support for Android APK files.

security-onion-solutions/security-onion

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management

robindavid/lsb-steganography

Python program to steganography files into images using the Least Significant Bit.