Network Forensics

corelight/zeek-community-id

Zeek support for Community ID flow hashing.

corelight/zeek-netsupport-detector

A Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.

corelight/zeek-quic

Bro analyzer that detects Google's QUIC protocol

corelight/zeek-spicy-ipsec

A Zeek IPSec protocol analyzer based on Spicy.

corelight/zeek-spicy-ospf

A Zeek OSPF packet analyzer based on Spicy.

corelight/zeek-spicy-stun

A Zeek STUN protocol analyzer based on Spicy.

corelight/zeek-spicy-wireguard

A Zeek Wireguard protocol analyzer based on Spicy.

camp0/aiengine

AIEngine is a next generation interactive/programmable Python/Ruby/Java/Lua and Go NIDS (Network intrusion detection system).

jgoyd/fourteen_endpoints

Shell Companies Inside Apple's Privacy Relay

lpefferkorn/ipdecap

Decapsulate traffic encapsulated within GRE, IPIP, 6in4, ESP (ipsec) protocols, can also remove IEEE 802.1Q (virtual lan) header. Works with pcap…

simsong/bulk_extractor

This is the development tree. Production downloads are at:

appliedsec/forensicscanner

Forensic Scanner

kcreyts/plugxdecoder

Decodes PlugX traffic and encrypted/compressed artifacts

nao-sec/ramnit_traffic_parser

Parsing Ramnit's traffic

r3mrum/loki-parse

A python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security…

kirkdjohnson/wireshark

Downloaded a packet capture (.pcapng) file from malware-traffic-analysis.net which was an example of an attempted attack against a webserver using…

ic3-512/linux-root-kit

End-to-end simulation of a Python dependency confusion attack, sudo privilege escalation (CVE-2025-32463), and rootkit-based persistence - with full…