SOCMIntelligence
emrekybs/socmintelligenceA modular OSINT & SOCMINT framework for social media intelligence, investigation, and public data analysis.
crawlerdigital-forensicsidentity-management+8
3
emrekybs/socmintelligenceA modular OSINT & SOCMINT framework for social media intelligence, investigation, and public data analysis.
hasamba/dfir-companionDFIR forensics companion server + capture extension
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
withsecureopensource/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
jeeberrr/honeypot-stuffStuff like malware analysis reports on things I captured from my honeypot
themittenmac/truetreeA command line tool for pstree-like output on macOS with additional pid capturing capabilities
karim852/kage-dfir-toolkitWindows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…
last-byte/persistencesniperPowershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines.…
doctorwebltd/malware-iocsCurated Indicators of Compromise (IOCs) from Doctor Web malware investigations, published for threat intelligence, detection engineering, and…
bkuan001/halo-recordTamper-evident audit trails for AI agents: hash-chained Runtime Records, dependency-free, verifiable by anyone.
gamelinux/passivednsA network sniffer that logs all DNS server replies for use in a passive DNS setup
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
dfir-iris/iris-webCollaborative Incident Response platform
microsoft/ics-forensics-toolsOpen-source forensics framework for analyzing Industrial PLC metadata and project files. Scans for suspicious artifacts in ICS environments to…
rabbitstack/fibratusSecurity sensor for realtime threat detection and protection
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
cyb3rfox/aurora-incident-responseIncident Response Documentation made easy. Developed by Incident Responders for Incident Responders