CovenantDecryptor
naacbin/covenantdecryptorDecrypts Covenant C2 communications by extracting RSA private keys from minidumps, recovering AES session keys, and converting network captures to…
command-and-controlcryptographydigital-forensics+4
37
naacbin/covenantdecryptorDecrypts Covenant C2 communications by extracting RSA private keys from minidumps, recovering AES session keys, and converting network captures to…
mandiant/silketwC# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…
trustedsec/tscopyPython tool that parses the NTFS $MFT to copy locked files during incident response, bypassing OS locks by reading raw disk locations. Supports…
andrewrathbun/dfirartifactmuseumThe goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact…
securityjoes/masterparserMasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
toxy4ny/rinhitCollects macOS and iOS artifacts to build timelines of network activity, cross-device identity, and physical location correlation for reconnaissance…
cakescats/airborn-ios-cve-2025-24252iOS Airborne vulnerabilities log artifact extractor from LogArchive CVE-2025-24252
hackura/xz-cve-2024-3094Python demo simulating CVE-2024-3094: a supply chain backdoor in XZ Utils with a trigger-based stealth activation.
forensicmatt/rswindowsthingiesRust-based Windows forensic toolkit for real-time MFT monitoring, event log streaming, and channel enumeration, enabling live system analysis and…
perkins-fund/malware-bibleFree educational courses in cybersecurity, reverse engineering, malware analysis, and programming designed to expand access, build practical skills,…
eurecom-s3/linux_screenshot_xwindowsVolatility plugin to extract X screenshots from a memory dump
tarunbharathe/zero-click-rce-incident-response-cve-2025-21298Technical investigation and host containment of a Critical-severity Zero-Click RCE exploit (CVE-2025-21298) using EDR telemetry and static malware…
zach115th/toolshellfinderScans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
paul-tew/liferWindows link file (shortcuts) examiner
sifalcon/detectionCurated collection of detection rules and IOCs extracted from DFIR engagements and malware analyses to support threat hunting, incident response, and…
withsecurelabs/flairLightweight batch script for semi-automated acquisition of key forensic artefacts from Windows hosts, using only native OS tools to support incident…