loki-parse
r3mrum/loki-parseA python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security…
data-exfiltrationdigital-forensicsforensics+5
13
r3mrum/loki-parseA python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security…
ic3-512/linux-root-kitEnd-to-end simulation of a Python dependency confusion attack, sudo privilege escalation (CVE-2025-32463), and rootkit-based persistence - with full…
pugazhendii22/keepass-exfil-forensicsNetwork forensics writeup + tooling for a TryHackMe DFIR challenge: reverses a hex→Base64→XOR exfiltration chain from PCAP traffic, then recovers a…
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
benadia/an-integrated-wireless-network-forensic-analysis-frameworkThis framework combines a set of existing open source tools into an integrated package that automates the forensics investigation process. It is able…
devzinh/ghosttraceRead-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks…
ahmed-tarek22752/rce-cve-2017-0199-detection-analysisThis repository contains a full blue-team malware analysis of a real malicious DOCX exploiting CVE-2017-0199. The lab includes sandbox execution,…
horsicq/detect-it-easyProgram for determining types of files for Windows, Linux and MacOS.
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
neo23x0/signature-baseYARA signature and IOC database for my scanners and tools
forrest-orr/monetaMoneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
invoke-ir/aceAutomated, Collection, and Enrichment Platform
xe1phix/parrotlinux-public-kiosk-projectSystematic Linux kernel hardening project implementing KSPP-recommended settings, module blacklisting, and restricted environment configuration for…
haruu77g/phantomprintPassive hybrid fingerprinting engine — identify hosts without sending a single packet
mandiant/citrix-ioc-scanner-cve-2023-3519
sherlock-project/sherlockHunt down social media accounts by username across social networks
sbilly/awesome-securityA collection of awesome software, libraries, documents, books, resources and cools stuffs about security.
moond4rk/hackbrowserdataExtract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).