Loki
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
digital-forensicsforensicshash-analysis+5
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
neo23x0/loki-rs🐍 High-performance, multi-threaded YARA & IOC scanner
winsiderss/systeminformerReal-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…
google/grrRemote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
usarmyresearchlab/dshellDshell is a network forensic analysis framework.
mikeroyal/digital-forensics-guideDigital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
rawfilejson/awesome-osint-arsenalOSINT & recon toolkit // 100+ tools, one-command installer, SOCMINT, GEOINT, network recon, dark web, forensics & more.
cisco/joyA package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
mozillazg/ptcpdumpeBPF-based packet analyzer that captures network traffic with automatic process, container, and Kubernetes pod metadata annotation, supporting…
idaholab/malcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…
bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
cryps1s/darksurgeonDARKSURGEON is a Windows packer project to empower incident response, digital forensics, malware analysis, and network defense.
nour833/stegoforgeThe ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run…
rjbhide/wireshark-forensics-pluginWireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…
thomasareed/pictModular incident response toolkit for collecting forensic data from potentially infected macOS endpoints, capturing browser artifacts, persistence…
synacktiv/sharkerA simple, reliable and reasonably fast network capture analyzer.
agent-hellboy/ltmltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…