DFIRHub
lascc/dfirhubSearch artifact paths, build collection scripts, and convert Sigma rules. All in one place.
forensicsinformation-gatheringdigital-forensics+4
94 days ago
lascc/dfirhubSearch artifact paths, build collection scripts, and convert Sigma rules. All in one place.
gmh5225/maldec-edrUnix endpoint detection and response solution using kernel-level mechanisms to detect anomalies and malware attacks in real time.
gmh5225/malwaredbCurated collection of 961 malware families (1.36 GB) in password-protected ZIP archives, organized by family and type for analysis and research.
rorywag/hayabusa-bulk-runnerBulk-run Hayabusa across a folder of KAPE collections, one run per host, with per-host reports and a cross-host triage dashboard
gilnett/wstraceStandalone zero-driver Windows system and API monitor in Rust
clausing/scriptsCollection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…
microsoft/routeros-scannerTool to scan for RouterOS (Mikrotik) forensic artifacts and vulnerabilities.
star-sg/random-scriptsCollection of DFIR and OSINT Python scripts for parsing malicious LNK samples, extracting OLE objects from MHTML, and hashing favicons to hunt…
sims718718/unifiedthreathuntingDocuments a structured, repeatable threat hunting methodology covering triggers, SMART hypotheses, feasibility gates, scoping, hunt plans, and…
thomaspoppelgaard/netscaler-ctx697096-checkerRead-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778): verifies build, CVE preconditions and upgrade risks, and sweeps public IoCs…
radkawar/aws-firmware-dumpAcquires the EBS disks of an AWS AMI you can launch, streaming snapshots via EBS direct APIs to a private S3 bucket with sha256 manifests and…
jeeberrr/honeypot-stuffStuff like malware analysis reports on things I captured from my honeypot
seekbytes/ipaGUI analyzer for deep-diving into PDF files. Detect malicious payloads, understand object relationships, and extract key information for threat…
wrongbaud/spidumpTool for reconstructing SPI flash images via logic analyzer captures
qsecure-labs/deadmatterOffset Independent Credential Extraction Tool
thakur2309/pagasus-proPython ADB-based Android device management and security audit toolkit with an interactive menu for root detection, permission dumps, debuggable app…
hasamba/dfir-companionDFIR forensics companion server + capture extension
msuhanov/easy_triageScripts to triage compromised systems (Linux, ESXi, FreeBSD/NetScaler)