
autopsy
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law…

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law…

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines.…

Collection of OpenCTI connectors that ingest and synchronize threat intelligence, IOCs, and CTI data from external sources like MISP and MITRE ATT&CK…

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…

Digital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…

Botnet command & control monitor

A Zeek package that detects when compromised eMudhra intermediate certificates are used in TLS 1.2 and below.

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…

Tool to search for IOCs related to HAFNIUM: CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065

Bash script to assess Linux host exposure to CVE-2026-31431, check kernel module status, apply mitigation by blocking algif_aead, and update kernel…

DShield Sensor Log Collection with ELK

HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be…

An Active Defense and EDR software to empower Blue Teams

Security event correlation engine for ELK stack

The purpose of this repository is to share KQL queries to help identify security misconfigurations, hunt for specific patterns, or detect malicious…

Script to check for IOC's created by ProxyNotShell (CVE-2022-41040 & CVE-2022-41082)

Python Decoders for Common Remote Access Trojans