
citrix-netscaler-triage
Forensic triage toolkit for Citrix NetScaler devices, featuring a Dissect-based IOC scanner for webshells, timestomping, and suspicious binaries,…

Forensic triage toolkit for Citrix NetScaler devices, featuring a Dissect-based IOC scanner for webshells, timestomping, and suspicious binaries,…

Remote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…

A portable C# utility for enumerating local and remote windows sessions

Encrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and…

Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack

Live monitoring tool for remote PowerShell sessions using ETW to capture and decode WinRM/PSRP protocol, providing command execution traces and…

Portable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote…

Distributed & real time digital forensics at the speed of the cloud

Parses Windows .evtx logs to identify remote connections and public IPs by analyzing EventIDs related to remote logins and sessions.

Proof-of-concept Velociraptor artifacts pack to showcase a remote Veeam forensics pipeline.

Full analysis of a never documented before Remote Access Trojan linked to Pjoao1578 toolchain

Technical investigation and host containment of a Critical-severity Zero-Click RCE exploit (CVE-2025-21298) using EDR telemetry and static malware…

This repository contains Velociraptor artifact and Chainsaw rules to help detect Microsoft Remote Access VPN activity

Extract registry and NTDS secrets from local or remote disk images