SOC-Investigation-CVE-2024-49138
basitsajidapply-stack/soc-investigation-cve-2024-49138Investigation and Incident Response report for LetsDefend Alert SOC335 (CVE-2024-49138 Exploitation)
digital-forensicseducationincident-response+3
basitsajidapply-stack/soc-investigation-cve-2024-49138Investigation and Incident Response report for LetsDefend Alert SOC335 (CVE-2024-49138 Exploitation)
securityronin/memory-forensicWalk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
wireshark/wiresharkCapture and analyze network traffic with deep packet inspection, protocol decoding across hundreds of protocols, and capture-file support for…
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
talha-nazeef-ahmed/alpc-enumeratorA Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
dfir-orc/dfir-orcForensics artefact collection tool for systems running Microsoft Windows
yamato-security/enablewindowslogsettingsDocumentation and scripts to properly enable Windows event logs.
cisagov/untitledgoosetoolUntitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to…
rotarydrone/globalunprotectDecrypt GlobalProtect configuration and cookie files.
accentusoft/linkscope_clientRepository for the LinkScope Client software.
6abd/horusAn OSINT / digital forensics tool built in Python
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
ares-sys/uefi_bootkit_softlandingFirst public analysis of SoftLanding UEFI bootkit: Ring -2 implant, CVE-2025-7029, 240+ Gigabyte boards, GPU AI evasion, dual C2. YARA + Sigma +…
rails/rails-forensics-cve-2026-66066Forensic toolkit and agent skills for investigating Rails Active Storage/libvips CVE-2026-66066: detects crafted blob indicators, exposure windows,…
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
piotr-kniaz/eslockdecryptorUtility for recovering ES File Explorer encrypted files (.eslock)