python-haystack
trolldbois/python-haystackProcess heap analysis framework - Windows/Linux - record type inference and forensics
binary-analysisdigital-forensicsforensics+2
95
trolldbois/python-haystackProcess heap analysis framework - Windows/Linux - record type inference and forensics
thomasareed/pictModular incident response toolkit for collecting forensic data from potentially infected macOS endpoints, capturing browser artifacts, persistence…
trustedsec/lnkmemaybeLnk crafting and research tools
raj3shp/persisthuntLinux Persistence Detection, Hunting and Artifact Collection script
jas502n/010-editor-templateBinary template repository for 010 Editor, providing .bt scripts for parsing executables, filesystem images, registry hives, and forensic artifacts…
ignacioj/whacamoleLive memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment…
skelsec/adiskreader-secretsdumpExtract registry and NTDS secrets from local or remote disk images
blakebratcher/wcw-cyberring-pav-decryptorCryptanalysis of a proprietary 1999 video DRM system. Recovers 61 encrypted wrestling videos from the WCW Internet Powerdisk CD-ROM through static…
synacktiv/cachedata_decryptA simple Toolkit to BF and decrypt Windows EntraId CacheData
farukalpay/neurocoreNeuroCore is a native macOS application that visualizes the internal structure of binary files using a Hilbert Curve mapping and Shannon Entropy…
matthw/malware_analysisPython toolkit for malware analysis, designed to inspect suspicious files and extract indicators of compromise for security investigations.
securest8/npm-incident-responseScanner for the keyv/cacheable supply-chain attack: detects compromised npm packages, verifies payload hashes, and finds persistence implants in repo…
sgnls/exchange-0days-202103IoC determination for exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
ic3-512/linux-root-kitEnd-to-end simulation of a Python dependency confusion attack, sudo privilege escalation (CVE-2025-32463), and rootkit-based persistence - with full…
duyduongduyduong/cve-2024-4577-exploitation-asyncrat-deployment-dfir-investigationInvestigation of CVE-2024-4577 exploitation and AsyncRAT deployment with DFIR artifacts, IoCs, and detection guidance.
duyduongduyduong/cve-2021-36934-dll-hijacking-dfir-investigationDFIR investigation resources for CVE-2021-36934, covering DLL hijacking, privilege-escalation detection, and forensic analysis of affected Windows…
wismansec/sharepoint-2026-pocPoC, IOCs, and detection logic for the SharePoint /_trust WS-Federation BinaryFormatter deserialization chain. Lab reconstruction covering…
karitamw/printnightmare-detection-mitigation-labSanitised Windows security lab demonstrating Active Directory administration, host and network detection, and layered mitigation of CVE-2021-34527.