rjbhide/wireshark-forensics-pluginWireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…
la3ar0v/tuxresponseAutomated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.
ncsc-nl/citrix-2025Digital forensics and incident response tool using YARA rules to scan Citrix NetScaler core dumps, disk images, and live hosts for signs of…
yeet-src/usbsnoopLive, system-wide USB transfer sniffer in eBPF — decodes USB traffic inline (control SETUP, SCSI, HID) from two universal URB hooks. No usbmon, no…
mayhamad/memtracerLive memory analysis tool for detecting reflectively loaded .NET DLLs by scanning process memory regions for abnormal flags, page types, and PE…
letsdefendio/simple-live-data-collectionClient-server tool for live data collection during incident response. Admin sends requests to clients to gather system information for forensic…
ignacioj/whacamoleLive memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment…
intezer/linux-explorerEasy-to-use live forensics toolbox for Linux endpoints
gmh5225/frida-meditCross-platform CUI process memory scanner built on Frida for finding, filtering, patching, and dumping live process memory during reverse engineering…
mandiant/citrix-ioc-scanner-cve-2023-3519Bash-based scanner detecting indicators of compromise from CVE-2023-3519 exploitation on Citrix ADC appliances, supporting live and forensic image…
kubeshark/kubesharkeBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via…
srixivas/pcapxray❄️ PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight…
cisco/joyA package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
tsale/awesome-dfir-skillsA curated collection of DFIR skills and workflows for InfoSec practitioners.
withsecurelabs/linuxcatscaleIncident Response collection and processing scripts with automated reporting scripts
theevidencehunter/forensixDigital Forensics Intelligence Framework
rewantchaudhari/nextjs-rce-incident-responseReal-world incident response for CVE-2025-55182 (React2Shell) — script injection, server remediation, and post-incident report
