Archived
HAFNIUM-IOC
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
digital-forensicsforensicsincident-response+3
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
cyb3rfox/aurora-incident-responseIncident Response Documentation made easy. Developed by Incident Responders for Incident Responders
microsoft/ics-forensics-toolsOpen-source forensics framework for analyzing Industrial PLC metadata and project files. Scans for suspicious artifacts in ICS environments to…
themittenmac/truetreeA command line tool for pstree-like output on macOS with additional pid capturing capabilities
volatilityfoundation/volatilityAn advanced memory forensics framework
viralmaniar/remote-desktop-caching-This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…
sleuthkit/scalpelFile carving and indexing tool for digital forensics, recovering files from disk images based on header/footer pattern matching, regular expressions,…
daffainfo/vol-rsVolatility 3 ported to Rust. Same output, much faster.
withsecurelabs/remotepspyLive monitoring tool for remote PowerShell sessions using ETW to capture and decode WinRM/PSRP protocol, providing command execution traces and…
fox-it/citrix-netscaler-triageForensic triage toolkit for Citrix NetScaler devices, featuring a Dissect-based IOC scanner for webshells, timestomping, and suspicious binaries,…
log2timeline/plasoDigital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…
orlikoski/skadiCollect, Process, and Hunt with host based data from MacOS, Windows, and Linux
eyesecurity/wp2shell-compromise-scanner-pluginRead-only WordPress plugin that scans for artifacts of the wp2shell exploit chain (CVE-2026-63030 / CVE-2026-60137)
itres-labs/cve-2025-31702Repository with tools, exploits, and material associated with the analysis and discovery process of CVE-2025-31702 and other related security issues.
vignesh-hp/lockbit-ransomware-analysisThreat intelligence and incident response case study on LockBit ransomware exploiting CVE-2023-4966 (Citrix Bleed).
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
