

macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR

Offset Independent Credential Extraction Tool

FWT is a security analysis and file monitoring tool that utilizes Sysmon events.

ESF modular ingestion tool for development and research.

Decapsulate traffic encapsulated within GRE, IPIP, 6in4, ESP (ipsec) protocols, can also remove IEEE 802.1Q (virtual lan) header. Works with pcap…

This is a repo for fetching Applocker event log by parsing the win-event log

Python script for carving Bitlocker VMK keys

Official repository for CTFTiny

A radare2 script to parse the gopclntab to facilitate Reverse Engineering Go binaries.

Documented SOC automation workflow using Wazuh, N8N, Caldera, and Velociraptor

Tool for reconstructing SPI flash images via logic analyzer captures

Fingerprint SSH clients and servers.

A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282,…

Recovery notes for proxmox advisory ID: PSA-2026-00043-1 (CVE-2023-54391)

Provides BigFix Fixlets and analyses to detect Log4j vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) across Windows and Linux…

Forensic Analysis and Local Replication of the OpenAI-Artifactory Privilege Escalation Incident (CVE-2026-65616)

Educational exploit for CVE-2022-30190 (Follina) demonstrating MSDT remote code execution via malicious Office documents, with detection and…