#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
essexrich/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…
wireshark/wiresharkWireshark's official code repository. You can keep the releases coming by donating at https://wiresharkfoundation.org/donate/.
abrignoni/ileappParses iOS and iPadOS forensic extractions into HTML, TSV, timeline, KML, and LAVA reports with modular artifact discovery and encrypted iTunes…
winsiderss/systeminformerReal-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
mobsf/mobile-security-framework-mobsfAutomated mobile application security testing framework for Android, iOS, and Windows. Performs static and dynamic analysis, malware detection, and…
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
angr/angrA powerful and user-friendly binary analysis platform!
oyesanyf/oshoosiclawAutonomous Rust endpoint security agent combining Ring-0 Windows driver and Linux eBPF pre-execution blocking, YARA detection, MITRE ATT&CK mapping,…
abrignoni/aleappAndroid Logs Events And Protobuf Parser
nikaiw/vmkatzExtract Windows credentials directly from VM memory snapshots and virtual disks
wireshark/wiresharkCapture and analyze network traffic with deep packet inspection, protocol decoding across hundreds of protocols, and capture-file support for…
horsicq/detect-it-easyProgram for determining types of files for Windows, Linux and MacOS.
radareorg/radare2UNIX-like reverse engineering framework and command-line toolset
kevoreilly/capev2Malware Configuration And Payload Extraction
skylot/jadxCommand-line and GUI tool for decompiling Android Dex and APK files into readable Java source code, with resource decoding, deobfuscation, and Smali…
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
blacktop/ipswiOS/macOS Research Swiss Army Knife
