
columbo
ML-assisted forensic analysis tool that automates memory, disk, and live system triage on Windows using Volatility 3, autorunsc, and sigcheck to…

ML-assisted forensic analysis tool that automates memory, disk, and live system triage on Windows using Volatility 3, autorunsc, and sigcheck to…

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.

The Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent to or from…

OSINT - Data Visualization - Blockchain - Awareness - Scam

Zeek detection for CVE-2020-16898-"Bad Neighbor"

Real-time anomaly detection system for Apache Struts CVE-2017-5638 exploit using streaming analytics, 3-gram byte analysis, and Count-Min Sketch.…

NFStream: a Flexible Network Data Analysis Framework.

DNS Dashboard for hunting and identifying beaconing

A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection

Default Detections for EDR

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

AI-based, context-driven network device ranking

Detect HTTP stalling attacks like slowloris with Bro

A canary designed to minimize the impact from certain Ransomware actors

Forensic intelligence platform that analyzes files, correlates threat indicators, maps behavior to MITRE ATT&CK, and generates actionable security…

C# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…

PETriage: A symbol-unified PE file reader for triage, built for multi-platform and multi-interface use.

IOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…