LogonTracer
jpcertcc/logontracerInvestigate malicious Windows logon by visualizing and analyzing Windows event log
ai-securitydigital-forensicsincident-response+2
3.3k1 month ago
jpcertcc/logontracerInvestigate malicious Windows logon by visualizing and analyzing Windows event log
devinblack001/ddos-reduction-systemAdaptive two-stage Layer 4 DDoS mitigation gateway using behavioral traffic analysis, Random Forest classification, and kernel-level ipset/iptables…
withsecureopensource/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
withsecurelabs/remotepspyLive monitoring tool for remote PowerShell sessions using ETW to capture and decode WinRM/PSRP protocol, providing command execution traces and…
guettaf-hossam/superdiagnostictoolAI-powered Windows diagnostic & auto-repair tool using Google Gemini. Detect crashes, optimize performance, scan for malware, and generate PowerShell…
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
withsecurelabs/flairLightweight batch script for semi-automated acquisition of key forensic artefacts from Windows hosts, using only native OS tools to support incident…
zhoucc-cpu/cve-2023-23397-detection-labDetection and mitigation research lab for CVE-2023-23397 using network and endpoint security telemetry.
aman-sharma-dev/netsentryxAn event-driven network monitoring platform that performs live packet capture (Npcap), low-latency traffic analytics, and unsupervised threat…
silverfort-open-source/latmaCollects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…
alloysecuregroup/phantomfsWindows honeypot using ProjFS to project decoy files that trigger Event Log and desktop alerts when accessed, with SMB remote session logging for…
nccgroup/windowsjoblockWindows Process Lockdown Tool using Job Objects
kfallahi/underlaycopyPowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads
jepaynemsft/wefflesBuild a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
neo23x0/raccineA Simple Ransomware Vaccine
harelsegev/prefetch-hash-crackerBrute-force tool that recovers full executable paths from Windows prefetch hashes using bodyfiles, supporting XP, Vista, and 2008 hash functions for…