packetsifterTool
packetsifter/packetsiftertoolPacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…
defensive-toolsdigital-forensicsforensics+5
93
packetsifter/packetsiftertoolPacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…
mandiant/threatpursuit-vmThreat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and…
kulkansecurity/gitxrayA multifaceted security tool which leverages Public GitHub REST APIs for OSINT, Forensics, Pentesting and more.
daddycocoaman/dumpscanFinding secrets in kernel and user memory
sbousseaden/evtx-attack-samplesCurated collection of Windows EVTX attack samples mapped to MITRE ATT&CK techniques, designed for testing detection scripts, DFIR training, and…
perkins-fund/malware-bibleFree educational courses in cybersecurity, reverse engineering, malware analysis, and programming designed to expand access, build practical skills,…
tonyphipps/meerkatA collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
securityjoes/masterparserMasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
rowingdude/analyzemftanalyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.
kd8bny/limeaideA python application designed to remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host.
securityjoes/forensicminerA really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
nccgroup/killedprocesscanaryA canary designed to minimize the impact from certain Ransomware actors
matthw/malware_analysisPython toolkit for malware analysis, designed to inspect suspicious files and extract indicators of compromise for security investigations.
hexastrike/ivanti-connect-secure-logs-parserA Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282,…
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
tclahr/uacPortable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
cristianzsh/forensictoolsCollection of forensic tools