Tools

google/timesketch

Collaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…

microsoft/avml

Portable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote…

grafana/loki

Horizontally scalable, multi-tenant log aggregation system that indexes labels instead of full text, integrates with Grafana, and is optimized for…

eh-amish/windows-defender-security-auditor-cve-2026-50656-

Read-only PowerShell security auditor for Windows endpoints and servers: checks Defender configuration, patch status, credentials, persistence,…

beenuar/aisoc

Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation.…

dfir-orc/dfir-orc

Forensics artefact collection tool for systems running Microsoft Windows

misp/misp-taxonomies

Taxonomies used in MISP taxonomy system and can be used by other information sharing tool.

immersive-labs-sec/bruteratel-detectiontools

A collection of Tools and Rules for decoding Brute Ratel C4 badgers

threatlabz/tools

Ransomware decryption and script deobfuscation utilities from a threat intelligence team, designed for incident responders and malware analysts.

theflink/hunt-weird-imageloads

Small tool to play with IOCs caused by Imageload events

joaocalciolari07/copyfail-guard

Defensive detection & mitigation tool for CVE-2026-31431 ("Copy Fail") — Linux kernel algif_aead LPE. No exploit code included.

mrt4ntr4/ntwarden

Inspect live Windows system internals: processes, services, network, kernel callbacks, SSDT, and per-process anomalies; detect hooks and rootkits…

merill/awesome-entra

😎 Awesome list of all things related to Microsoft Entra

northpolesec/santa

A binary and file access authorization system for macOS.

hazcod/ransomwhere

A PoC ransomware sample to test out your ransomware response strategy.

theevidencehunter/forensix

Digital Forensics Intelligence Framework

nccgroup/impossibletravelloganalysis

Basic log analysis tool to detect impossible travel via IP address geographic information

nccgroup/windowsjoblock

Windows Process Lockdown Tool using Job Objects