
hayabusa
Multi-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…

Multi-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…

Script for automating Linux memory capture and analysis

Self-hosted incident response platform with ticket management, automated reaction playbooks, task tracking, and dashboards for streamlining alert…

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

Incident Response - Fast suspicious file finder

Extracts and downloads Snap Map media by coordinates for OSINT, forensic analysis, and research. Supports metadata logging and bulk download.

Static analysis tool for investigating potentially malicious Microsoft Excel files, extracting metadata, macros, and embedded objects to aid digital…

Wireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…

Cross-platform registry browser for raw Windows registry files

ThePhish: an automated phishing email analysis tool

Automagically extract forensic timeline from volatile memory dump

Free hands-on digital forensics labs for students and faculty

Labs for Practical Malware Analysis & Triage

DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.

A command line tool for pstree-like output on macOS with additional pid capturing capabilities

Incident Response Triage - Windows Evidence Collection for Forensic Analysis

Tool to extract the $UsnJrnl from an NTFS volume

Commandline low level file extractor for NTFS