flare-floss
mandiant/flare-flossFLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
disk-forensicsstatic-analysisdynamic-analysis-sandboxing+8
4.1k
mandiant/flare-flossFLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
velocidex/winpmemThe multi-platform memory acquisition tool.
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
sunweb3sec/defihacklabsReproduce DeFi hacked incidents using Foundry.
circl/ail-frameworkAIL framework - Analysis Information Leak framework. Project moved to https://github.com/ail-project
mvt-project/androidqfandroidqf (Android Quick Forensics) helps quickly gathering forensic evidence from Android devices, in order to identify potential traces of…
mvt-project/mvtForensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…
cea-sec/usbsasTool and framework for securely reading untrusted USB mass storage devices.
dsheirer/sdrtrunkA cross-platform java application for decoding, monitoring, recording and streaming trunked mobile and related radio protocols using Software Defined…
omerbenamram/evtxA Fast (and safe) parser for the Windows XML Event Log (EVTX) format
xephora/threat-remediation-scriptsThis repository contains a list of new remediation scripts.
sleuthkit/sleuthkitForensic library and CLI toolkit for analyzing disk and file system images, recovering deleted data, generating timelines, and validating evidence…
perplexityai/numbatVisibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and forensic reconstruction.
ericzimmerman/kapefilesThis repository serves as a place for community created Targets and Modules for use with KAPE.
microsoft/avmlPortable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote…
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
rorywag/hayabusa-bulk-runnerBulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard
essexrich/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…