Tools

emalderson/thephish

ThePhish: an automated phishing email analysis tool

randomaccess3/awesome-bec

Repository of attack and defensive information for Business Email Compromise investigations

cado-security/dfir_resources_revil_kaseya

Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack

spectralzero/netscope

Offline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…

viralmaniar/remote-desktop-caching-

This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…

strangerealintel/cyberthreatintel

Analysis of malware and Cyber Threat Intel of APT and cybercriminals groups

disqualifier/psa-2026-00043-recovery

Recovery notes for proxmox advisory ID: PSA-2026-00043-1 (CVE-2023-54391)

guillaumemeyer/watermarks-remover

A privacy-first app that strips AI watermarks from content you own.

bishopfox/unredacter

Never ever ever use pixelation as a redaction technique

jessek/hashdeep

Cross-platform hashing toolset for computing message digests (MD5, SHA-1, SHA-256, Tiger, Whirlpool) with recursive directory traversal and file…

mkorman90/regipy

Regipy is an os independent python library for parsing offline registry hives

smeegesec/hashtag

Password Hash Identification

themittenmac/truetree

A command line tool for pstree-like output on macOS with additional pid capturing capabilities

mazx0p/threathound

Automated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…

harris21/afot

Automation Forensics Tool for Windows

iomoath/filewatchtower

FWT is a security analysis and file monitoring tool that utilizes Sysmon events.

bontchev/whodunit

Recognizing the most likely APT groups responsible for an incident