
persisthunt
Linux Persistence Detection, Hunting and Artifact Collection script

Linux Persistence Detection, Hunting and Artifact Collection script

Read-only triage script for WordPress sites after PHP2Shell (CVE-2026-109618, CVE-2026-109619). Checks for signs of compromise and writes a report…

A lightweight CLI tool to detect and reconstruct cropped images vulnerable to Acropalypse (CVE-2023-21036 and CVE-2023-28303) written in Python.

PowerShell script that automates the WinRE mitigation workflow for CVE-2026-45585, with verification steps and conditional commit to avoid…

Automated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.

Extract AutoIt scripts embedded in PE binaries

Python script for carving Bitlocker VMK keys


Detection Script for MongoBleed Exploitation

A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282,…

ThePhish: an automated phishing email analysis tool

Incident Response collection and processing scripts with automated reporting scripts

Check to see if your Palo Alto firewall has been compromised by running script againt support bundle.

Detection and sanitization for Acropalypse Now - CVE-2023-21036

Collection of DFIR and OSINT Python scripts for parsing malicious LNK samples, extracting OLE objects from MHTML, and hashing favicons to hunt…

A python script for digital image steganography using Fast Fourier Transform.

A python script developed to process Windows memory images based on triage type.

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.