
brawl-public-game-001
Data from a BRAWL Automated Adversary Emulation Exercise

Data from a BRAWL Automated Adversary Emulation Exercise

Automated PowerShell script for forensically sound Windows memory acquisition, including crash/raw dumps, pagefile collection, triage artifacts, and…

Automated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.

macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR

Gallery Vault dump recovery tool with automated discovery, key derivation and automatic media restoration.

A modular OSINT & SOCMINT framework for social media intelligence, investigation, and public data analysis.

Automated forensic script hunting for cve-2019-19781

Code written as part of our various malware investigations

Collaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…

Cortex: a Powerful Observable Analysis and Active Response Engine

Technical Analysis of Bibi-Windows Wiper Targeting Israeli Organizations

Curated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…

Real-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…

Forensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…

Dshell is a network forensic analysis framework.

Collection of Python scripts for malware analysis, file format parsing, hashing, and forensic triage, including PDF, OLE, and XOR analysis utilities.

Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…

Multi-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…