Tools

terminaljunki3/cve-2024-3400-checker

Check to see if your Palo Alto firewall has been compromised by running script againt support bundle.

lethal-forensics/memprocfs-analyzer

Automates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.

anttikurittu/kirjuri

Kirjuri is a web application for managing cases and physical forensic evidence items.

sherlock-project/sherlock

Hunt down social media accounts by username across social networks

arkime/arkime

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

ryandfir/hindsight

Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

emalderson/thephish

ThePhish: an automated phishing email analysis tool

nightbringer21/fridump

Cross-platform memory dumper using Frida to extract accessible memory from iOS, Android, and Windows applications for forensic analysis and…

anssi-fr/bmc-tools

RDP Bitmap Cache parser

apr4h/cobaltstrikescan

Scan files or process memory for CobaltStrike beacons and parse their configuration

cyberdefenders/email-header-analyzer

E-Mail Header Analyzer

forrest-orr/moneta

Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs

darkquasar/azurehunter

A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

mkorman90/regipy

Regipy is an os independent python library for parsing offline registry hives

sevagas/swap_digger

swap_digger is a tool used to automate Linux swap analysis during post-exploitation or forensics. It automates swap extraction and searches for Linux…