Network Forensics

kavan00/android-projector-c2-malware

Breakdown of a c2-network of chinese beamers - SilentSDK-Analysis

agent-hellboy/ltm

ltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…

emrekybs/bluefish

Automation tool designed to simplify the analysis of PCAP (Packet Capture) files

knqyf263/ndff

A flow-based network monitor with Deep Packet Inspection

r3mrum/loki-parse

A python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security…

synacktiv/pcapan

A pcap capture analysis helper

nccgroup/mortimer

A collection of scripts for processing network forensics type data and intelligence, mainly into a postgres database.

securityronin/memory-forensic

Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.

corelight/zeek-spicy-ipsec

A Zeek IPSec protocol analyzer based on Spicy.

corelight/zeek-spicy-wireguard

A Zeek Wireguard protocol analyzer based on Spicy.

corelight/zeek-quic

Bro analyzer that detects Google's QUIC protocol

corelight/zeek-spicy-ospf

A Zeek OSPF packet analyzer based on Spicy.

darnellwashingtonjr94-art/sandb0x-xtract0r

Automated cross-platform sandbox that detonates suspicious files in isolated VMs/emulators, captures network and memory artifacts, and creates LLM…

corelight/zeek-spicy-stun

A Zeek STUN protocol analyzer based on Spicy.

ic3-512/linux-root-kit

End-to-end simulation of a Python dependency confusion attack, sudo privilege escalation (CVE-2025-32463), and rootkit-based persistence - with full…

benadia/an-integrated-wireless-network-forensic-analysis-framework

This framework combines a set of existing open source tools into an integrated package that automates the forensics investigation process. It is able…