
wireshark-forensics-plugin
Wireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…

Wireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…

It was developed to speed up the processes of SOC Analysts during analysis

No-root network monitor, firewall and PCAP dumper for Android

Policy engine and EDR for AI agent fleets and developer workstations. Monitors tool calls, file access, network flows, and process execution with…

Search and extract blob files on the Ethereum Blockchain network

Analyzes .pcapng files to generate HTML reports for network traffic inspection and forensic review.

Automated, Collection, and Enrichment Platform

Offensive & defensive Linux kernel security research focused on rootkit behavior, observable artifacts and detection.

SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough

A network sniffer that logs all DNS server replies for use in a passive DNS setup

Indicators of Compromise from Amnesty International's cyber investigations

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…

Defanged Indicator of Compromise (IOC) Extractor.

NTLMRawUnhide.py is a Python3 script designed to parse network packet capture files and extract NTLMv2 hashes in a crackable format. The following…

Extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers

A tool for processing a lot of pcaps using tshark

Extract indicators of compromise from text, including "escaped" ones.