Kage-DFIR-toolkit
karim852/kage-dfir-toolkitWindows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…
defensive-toolsdigital-forensicsforensics+8
8
karim852/kage-dfir-toolkitWindows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…
kaandemir993/stealc-stealer-runtimebroker-hollowing-c2-extraction-payload-extraction-analysisReverse engineering analysis of StealC Stealer, an info-stealer that uses RuntimeBroker.exe hollowing, C2 infrastructure, and payload extraction.…
v-pun215/tourmalineReverse engineering notes, deobfuscated source, IOCs, and YARA rules for the Tourmaline ClickFix Python RAT, covering its DNS tunnel and blockchain…
pinksawtooth/how_to_become_a_malware_analystCurated guide to becoming a malware analyst, covering essential knowledge, reverse engineering, analysis tools, and LLM-assisted learning with…
jithinkrishnanrs/cve-2026-67401-cpanel-emailtrack-sqliRead-only IOC scanner and mitigation toolkit for cPanel & WHM EmailTrack SQL injection (CVE-2026-67401). Performs version fingerprinting, file…
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
daffainfo/vol-rsVolatility 3 ported to Rust. Same output, much faster.
barnew-st/ecdsa-private-key-recoveryA cryptographic research tool for analyzing signature vulnerabilities
adisasoc/cve-2024-49138-soc-investigationSOC investigation of CVE-2024-49138 exploitation involving brute-force activity, PowerShell execution, malicious payload analysis, privilege…
amperclock/cve-2023-32784-kdbxpassdmpRetrieves the master password from Keepass memory dump, using a hint of bruteforce.
withsecurelabs/esfangESF modular ingestion tool for development and research.
withsecurelabs/flairLightweight batch script for semi-automated acquisition of key forensic artefacts from Windows hosts, using only native OS tools to support incident…
nadineelliottcyber/soc335-cve-2024-49138-investigationSOC investigation of a CVE-2024-49138 exploitation alert using log analysis, threat intelligence, and endpoint containment.
jwa7470/cve-2026-20131-post-incident-written-reportPost-incident report on CVE-2026-20131 (CVSS 10.0), a Cisco FMC insecure deserialization vulnerability exploited by Interlock ransomware. Details…
ledlight33/copyfail-dfirInteractive DFIR walkthrough of CVE-2026-31431 (Copy Fail) - from SIEM alert to confirmed verdict. Real Volatility 3 commands, verified methodology.
habibkaratas/sorry-ransomware-analysisSorry ransomware (.sorry) IOCs, YARA rules and forensic analysis - CVE-2026-41940 cPanel campaign
3tternp/cve-2026-41940---cpanel-whm-checkThis is the office check script provided by cPanel for all the users who are using cPanel
shahidmallaofficial/cpanel-cve-2026-41940-fixOne-shot detection and remediation for cPanel/WHM servers compromised via CVE-2026-41940, including IOC checks, malware cleanup, C2 blocking, and…