#1Digital forensics, evidence collection, timeline analysis, and incident investigation tools.
Kitploit recommended
nextronsystems/iocsIndicators of compromise from to analysis and research by Nextron Threat Research team
eddyflores100-lang/taikotalent-phishing-iocsIoCs, attack chain & detection for the taikotalent.xyz fake-Taiko-recruiter campaign delivering a self-deleting Bash trojan via the paste-in-terminal…
gmh5225/minidumpreaderParses Windows MiniDump (MDMP) files with Kaitai Struct, extracting memory strings and scanning them against YARA rules for forensic and malware…
ahmadhassan-bted/nasunoAI audio watermark removal & forensic anti-attribution toolkit. Neutralizes Suno, Udio, and neural fingerprints with ISO 226 perceptual masking.
lascc/dfirhubSearch artifact paths, build collection scripts, and convert Sigma rules. All in one place.
gmh5225/maldec-edrUnix endpoint detection and response solution using kernel-level mechanisms to detect anomalies and malware attacks in real time.
gmh5225/malwaredbCurated collection of 961 malware families (1.36 GB) in password-protected ZIP archives, organized by family and type for analysis and research.
rorywag/hayabusa-bulk-runnerBulk-run Hayabusa across a folder of KAPE collections, one run per host, with per-host reports and a cross-host triage dashboard
gilnett/wstraceStandalone zero-driver Windows system and API monitor in Rust
clausing/scriptsCollection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…
microsoft/routeros-scannerTool to scan for RouterOS (Mikrotik) forensic artifacts and vulnerabilities.
star-sg/random-scriptsCollection of DFIR and OSINT Python scripts for parsing malicious LNK samples, extracting OLE objects from MHTML, and hashing favicons to hunt…
sims718718/unifiedthreathuntingDocuments a structured, repeatable threat hunting methodology covering triggers, SMART hypotheses, feasibility gates, scoping, hunt plans, and…
thomaspoppelgaard/netscaler-ctx697096-checkerRead-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778): verifies build, CVE preconditions and upgrade risks, and sweeps public IoCs…
radkawar/aws-firmware-dumpAcquires the EBS disks of an AWS AMI you can launch, streaming snapshots via EBS direct APIs to a private S3 bucket with sha256 manifests and…
jeeberrr/honeypot-stuffStuff like malware analysis reports on things I captured from my honeypot
seekbytes/ipaGUI analyzer for deep-diving into PDF files. Detect malicious payloads, understand object relationships, and extract key information for threat…
wrongbaud/spidumpTool for reconstructing SPI flash images via logic analyzer captures
