kaandemir993/darktortilla-rat-telegram-exfiltration-payload-extraction-analysisReverse engineering analysis of DarkTortilla RAT, a sophisticated malware that steals credit card data, decrypts browser passwords, and exfiltrates…
fox-it/citrix-netscaler-triageForensic triage toolkit for Citrix NetScaler devices, featuring a Dissect-based IOC scanner for webshells, timestomping, and suspicious binaries,…
disqualifier/psa-2026-00043-recoveryRecovery notes for proxmox advisory ID: PSA-2026-00043-1 (CVE-2023-54391)
dahnutz/zimbra-cve-2026-73570-irDetection-first incident-response toolkit for Zimbra administrators investigating CVE-2026-73570. Searches logs for exploit indicators, examines…
sbousseaden/evtx-attack-samplesCurated collection of Windows EVTX attack samples mapped to MITRE ATT&CK techniques, designed for testing detection scripts, DFIR training, and…
withsecurelabs/remotepspyLive monitoring tool for remote PowerShell sessions using ETW to capture and decode WinRM/PSRP protocol, providing command execution traces and…
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
bakos-sandor-nx/teamcity-cve-2026-63077-remediationJetBrains TeamCity On-Premises CVE-2026-63077 Emergency Hardening & Patch Runbook Package
daffainfo/vol-rsVolatility 3 ported to Rust. Same output, much faster.
barnew-st/ecdsa-private-key-recoveryA cryptographic research tool for analyzing signature vulnerabilities
adisasoc/cve-2024-49138-soc-investigationSOC investigation of CVE-2024-49138 exploitation involving brute-force activity, PowerShell execution, malicious payload analysis, privilege…
amperclock/cve-2023-32784-kdbxpassdmpRetrieves the master password from Keepass memory dump, using a hint of bruteforce.
withsecurelabs/esfangESF modular ingestion tool for development and research.
withsecurelabs/flairLightweight batch script for semi-automated acquisition of key forensic artefacts from Windows hosts, using only native OS tools to support incident…
withsecurelabs/macostriagecollectionscriptCollects comprehensive triage data from macOS for incident response, including system logs, file listings, browser data, shell history, and…
withsecurelabs/volatility-pluginsVolatility plugins for memory forensics, including detection of Gargoyle memory scanning evasion techniques.
fireeye/pywintracePython ctypes wrapper for Event Tracing for Windows (ETW) enabling session control, event capture, and custom callbacks for security monitoring and…
withsecurelabs/radare2-scriptsCollection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…
