fox-it/citrix-netscaler-triageForensic triage toolkit for Citrix NetScaler devices, featuring a Dissect-based IOC scanner for webshells, timestomping, and suspicious binaries,…
citrix/ioc-scanner-cve-2019-19781Indicator of Compromise Scanner for CVE-2019-19781
gs-ai/amber-iciAMBER ICI v5: local-first Ollama investigative command center with case-scoped evidence, agent chains, hybrid retrieval, streaming analysis, graph…
itres-labs/cve-2025-31702Repository with tools, exploits, and material associated with the analysis and discovery process of CVE-2025-31702 and other related security issues.
jithinkrishnanrs/stylesmuggler-ioc-toolkitStyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells,…
jithinkrishnanrs/cve-2026-67401-cpanel-emailtrack-sqliRead-only IOC scanner and mitigation toolkit for cPanel & WHM EmailTrack SQL injection (CVE-2026-67401). Performs version fingerprinting, file…
michaael01/letsdefend--soc-342-cve-2025-53770-sharepoint-exploit-toolshellDetailed walkthrough of CVE-2025-53770 (ToolShell) SharePoint zero-day exploitation, including RCE analysis, MachineKey exfiltration, payload…
security-onion-solutions/security-onionSecurity Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
mandiant/ioc-scanner-cve-2019-19781Indicator of Compromise Scanner for CVE-2019-19781
mvt-project/mvtForensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
nour833/stegoforgeThe ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run…
k1nd0ne/volwebA centralized and enhanced memory analysis platform
kjean13/adftActive Directory Forensic Toolkit : Detect & reconstruct AD attacks from Windows event logs (EVTX)
clark-prog/blackout-publicBlackout — The Official Blackout Public FAFO Repo.
