dfirtrack
dfirtrack/dfirtrackSystem-based incident response tracking application for managing large-scale DFIR cases, with import/export, task workflows, and artifact tracking…
digital-forensicsforensicsincident-response
dfirtrack/dfirtrackSystem-based incident response tracking application for managing large-scale DFIR cases, with import/export, task workflows, and artifact tracking…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
tclahr/uacPortable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…
adrecon/adreconPowerShell tool that extracts Active Directory artifacts via LDAP or ADWS and generates Excel reports for auditing, DFIR, and penetration testing.
juanceresa/sift-kgTurn any collection of documents into a knowledge graph. Extract entities and relationships via LLM, deduplicate with your approval. Map domains,…
ang13t/dronextractDigital forensics suite for DJI drones that parses telemetry files, extracts hidden data via steganography, visualizes flight paths, and detects…
invictus-ir/alfaAutomated forensic analysis tool for Google Workspace audit logs. Acquires all log types, maps events to MITRE ATT&CK Cloud Framework, and identifies…
korczis/foremostFile carving utility that recovers deleted files from disk images and raw drives by matching headers, footers, and internal structures via…
botherder/androidqfPortable forensic acquisition tool for Android devices that collects relevant data via USB debugging to identify potential spyware or compromise…
ivancabrera02/srhollowExtracts LSA secrets and DPAPI keys from Windows registry hives via existing or newly created VSS shadow copies, with an inline regf parser and…
kaandemir993/darktortilla-rat-telegram-exfiltration-payload-extraction-analysisReverse engineering analysis of DarkTortilla RAT, a sophisticated malware that steals credit card data, decrypts browser passwords, and exfiltrates…
agent-hellboy/ltmltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…
wrongbaud/spidumpTool for reconstructing SPI flash images via logic analyzer captures
chrism09/knx-bus-dumpA tool to listen on a KNX bus via TPUART and the Calimero Project suite and to dump the data from the packets into a Wireshark-Compatible file hex…
kaandemir993/formbook-payload-extraction-xor-decryption-net-assembly-analysisReverse engineering analysis of Formbook, an info-stealer that uses .NET assembly manipulation and XOR decryption. Full payload extracted via x32dbg,…
sumidcyber/zeroscout🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…
kaandemir993/python-shellcode-anydesk-apc-injection-remote-ip-address-analysisReverse engineering write-up of Python shellcode that APC-injects into AnyDesk, exfiltrates to a C2 over HTTPS with AES/RSA, and persists via…