Tools

last-byte/persistencesniper

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines.…

sherlock-project/sherlock

Hunt down social media accounts by username across social networks

orlikoski/skadi

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

withsecurelabs/chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

r3nzsec/irflow-timeline

DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…

shredzwho/ig-detective

OSINT tool researched and designed to hunt down IG handles

kunai-project/kunai

eBPF-based Linux security monitor and threat hunter providing chronologically ordered, container-aware events with on-host correlation for incident…

tonyphipps/meerkat

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

bcoles/rootkit-signal-hunter

Detect Linux rootkits which use signals to elevate process privileges.

hasherezade/hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…

mhaggis/adtrapper

Hunt Smarter, Hunt Harder

bohops/rogueassemblyhunter

Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.

dcscoder/exchange_ioc_hunter

CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065

ahmedkhlief/apt-hunter

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of…

cameloo1/sharepoint-toolshell-micro-postmortem

Reproducible incident micro-postmortem for on-prem Microsoft SharePoint “ToolShell” (CVE-2025-53770): ATT&CK snapshot, “logs that matter” table,…

cyb3rtus/keepass_cve-2023-24055_yara_rule

Contains a simple yara rule to hunt for possible compromised KeePass config files