iLEAPP
abrignoni/ileappParses iOS and iPadOS forensic extractions into HTML, TSV, timeline, KML, and LAVA reports with modular artifact discovery and encrypted iTunes…
digital-forensicsforensicsincident-response+3
1.4k
abrignoni/ileappParses iOS and iPadOS forensic extractions into HTML, TSV, timeline, KML, and LAVA reports with modular artifact discovery and encrypted iTunes…
omerbenamram/evtxA Fast (and safe) parser for the Windows XML Event Log (EVTX) format
rabbitstack/fibratusSecurity sensor for realtime threat detection and protection
nikaiw/vmkatzExtract Windows credentials directly from VM memory snapshots and virtual disks
rorywag/hayabusa-bulk-runnerBulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
karim852/kage-dfir-toolkitWindows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…
m0vi0/pacmapGraph-first network traffic visualizer for live capture and PCAP replay with checkpoint diffing, path tracing, and Wireshark-style display filters…
intrudify/mini-shai-hulud-scannerScanner for the Mini Shai-Hulud npm/PyPI supply chain worm (NHS CC-4781 · CVE-2026-45321). Detects gh-token-monitor persistence, payload artefacts,…
bitranox/fingerprintMonitoring Registry and File Changes in Windows
adham504/sentinelthread-forensicsHigh-speed Windows forensic triage platform that orchestrates the Hayabusa engine to transform raw EVTX logs into prioritized threat timelines with…
andreafortuna/autotimelinerAutomagically extract forensic timeline from volatile memory dump
seyyidkadir/filedumperWindows memory forensics tool for dumping files from process memory regions, searching byte patterns (PDF, JPG, SWF), and performing live process…
lupovis/honeypot-for-cve-2025-59287-wsusDefensive PoC decoy for CVE-2025-59287 (WSUS) - emulates WSUS endpoints, captures request bodies and metadata, saves evidence for forensic analysis,…
0vercl0k/kdmp-parserA Windows kernel dump C++ parser library with Python 3 bindings.
sobri3195/pegasus-malware-scanMulti-layered malware scanner combining hash-based verification, behavioral analysis, and sandbox execution for threat detection, incident response,…
travisfoley/dfirtriageDigital forensic acquisition tool for Windows based incident response.