Archived
DAMM
504ensicslabs/dammDifferential Analysis of Malware in Memory
digital-forensicsforensicsincident-response+3
215
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
mandiant/ioc-scanner-cve-2019-19781Indicator of Compromise Scanner for CVE-2019-19781
sucuri-labs/cve-2025-57819-ioc-checkThis is repository contains a script to check for current IOCs listed in the freepbx forum topic of the CVE-2025-57819
cado-security/rip_rawRip Raw is a small tool to analyse the memory of compromised Linux systems.
anttikurittu/kirjuriKirjuri is a web application for managing cases and physical forensic evidence items.
snovvcrash/usbripTracking history of USB events on GNU/Linux
emalderson/thephishThePhish: an automated phishing email analysis tool
cyb3rfox/aurora-incident-responseIncident Response Documentation made easy. Developed by Incident Responders for Incident Responders
mkorman90/regipyRegipy is an os independent python library for parsing offline registry hives
travisfoley/dfirtriageDigital forensic acquisition tool for Windows based incident response.
joeavanzato/trawlerPowerShell script helping Incident Responders discover potential adversary persistence mechanisms.
corelight/community-id-specAn open standard for hashing network flows into identifiers, a.k.a "Community IDs".
neo23x0/mongobleed-detectorDetection Script for MongoBleed Exploitation
onsec-fr/cve-2019-19781-forensicAutomated forensic script hunting for cve-2019-19781