BareMetal-RAM-Dumper
piat0n/baremetal-ram-dumperA bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory.
data-recoverydigital-forensicsexploitation+3
piat0n/baremetal-ram-dumperA bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory.
viralmaniar/remote-desktop-caching-This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…
carmaa/inceptionInception is a physical memory manipulation and hacking tool exploiting PCI-based DMA. The tool can attack over FireWire, Thunderbolt, ExpressCard,…
sbousseaden/evtx-attack-samplesCurated collection of Windows EVTX attack samples mapped to MITRE ATT&CK techniques, designed for testing detection scripts, DFIR training, and…
strangerealintel/cyberthreatintelAnalysis of malware and Cyber Threat Intel of APT and cybercriminals groups
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…
cado-security/dfir_resources_revil_kaseyaResources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack
ufrisk/pcileechDirect Memory Access (DMA) Attack Software
snapattack/damn-vulnerable-log4j-appVulnerable web application to test CVE-2021-44228 / log4shell and forensic artifacts from an example attack
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
emalderson/thephishThePhish: an automated phishing email analysis tool
themittenmac/truetreeA command line tool for pstree-like output on macOS with additional pid capturing capabilities
mazx0p/threathoundAutomated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…
iomoath/filewatchtowerFWT is a security analysis and file monitoring tool that utilizes Sysmon events.
securest8/npm-incident-responseScanner for the keyv/cacheable supply-chain attack: detects compromised npm packages, verifies payload hashes, and finds persistence implants in repo…
jessek/hashdeepCross-platform hashing toolset for computing message digests (MD5, SHA-1, SHA-256, Tiger, Whirlpool) with recursive directory traversal and file…
