iocs
nextronsystems/iocsIndicators of compromise from to analysis and research by Nextron Threat Research team
forensicsincident-responseioc-management+4
232h 26m ago
nextronsystems/iocsIndicators of compromise from to analysis and research by Nextron Threat Research team
omerbenamram/evtxA Fast (and safe) parser for the Windows XML Event Log (EVTX) format
osquery/osquerySQL powered operating system instrumentation, monitoring, and analytics.
abrignoni/ileappParses iOS and iPadOS forensic extractions into HTML, TSV, timeline, KML, and LAVA reports with modular artifact discovery and encrypted iTunes…
idaholab/malcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
invictus-ir/alfaAutomated forensic analysis tool for Google Workspace audit logs. Acquires all log types, maps events to MITRE ATT&CK Cloud Framework, and identifies…
hasamba/dfir-companionDFIR forensics companion server + capture extension
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
nikaiw/vmkatzExtract Windows credentials directly from VM memory snapshots and virtual disks
threatray/threat-researchIoCs and YARA rules from Threatray's Threat Research
clausing/scriptsCollection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…
cicd-sensor/cicd-sensoreBPF-powered runtime security sensor for CI/CD pipelines. Detects supply-chain attacks, logs process ancestry and file access, and provides forensic…
rorywag/hayabusa-bulk-runnerBulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard
rabbitstack/fibratusSecurity sensor for realtime threat detection and protection
sepinf-inc/ipedIPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…
microsoft/avmlPortable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote…