Digital Forensics

mandiant/capa

Rule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…

mandiant/flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on…

oisf/suricata

Open-source network IDS/IPS/NSM engine for real-time traffic inspection, intrusion detection and prevention, protocol analysis, and rule-based threat…

darthton/blackbone

Windows memory hacking library

frankwxu/digital-forensics-lab

Free hands-on digital forensics labs for students and faculty

alessandroz/lazagne

Cross-platform credential recovery tool that extracts stored passwords from browsers, email clients, databases, system mechanisms, and network…

bishopfox/unredacter

Never ever ever use pixelation as a redaction technique

ufrisk/pcileech

Direct Memory Access (DMA) Attack Software

security-onion-solutions/securityonion

Open-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…

intelowlproject/intelowl

Scalable threat intelligence platform that enriches observables and files using 200+ analyzers, with built-in GUI, REST API, and automated workflows…

volatilityfoundation/volatility3

Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…

clong/detectionlab

Automate the creation of a lab environment complete with security tooling and logging best practices

velocidex/velociraptor

Digging Deeper....

mandiant/flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

sleuthkit/sleuthkit

Forensic library and CLI toolkit for analyzing disk and file system images, recovering deleted data, generating timelines, and validating evidence…

rizinorg/rizin

UNIX-like reverse engineering framework and command-line toolset.