Douglas-042
emrekybs/douglas-042Triages a suspect Windows machine in minutes. Collects processes, services, autoruns, event logs and forensic artifacts, flags attacker activity, and…
forensicsincident-responseinformation-gathering+1
44
emrekybs/douglas-042Triages a suspect Windows machine in minutes. Collects processes, services, autoruns, event logs and forensic artifacts, flags attacker activity, and…
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
osbornepro/btps-secpackPowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…
intrudify/mini-shai-hulud-scannerScanner for the Mini Shai-Hulud npm/PyPI supply chain worm (NHS CC-4781 · CVE-2026-45321). Detects gh-token-monitor persistence, payload artefacts,…
manishrawat21/analysisHands-on analysis of common APT attack techniques, focused on how they show up in logs and how defenders can realistically detect them.
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
paspke/scavenger_scannerDetect CVE-2025-54313 eslint-config-prettier supply chain attack IOCs on Windows
zedocun/soc-investigation-powershell-edrfreezeSOC investigation of CVE-2024-49138 exploitation alert involving PowerShell, EDRFreeze execution, and defense evasion behavior in a simulated…
shadowopcode/desckvb-ratFull analysis of a never documented before Remote Access Trojan linked to Pjoao1578 toolchain
securityjoes/masterparserMasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
qazeer/farsightadPowerShell script that aim to help uncovering (eventual) persistence mechanisms deployed by a threat actor following an Active Directory domain…
ilhamrzr/rar-anomaly-inspectorDefensive PowerShell tool for static inspection of RAR archives and detection of CVE-2025-8088 path traversal anomalies.
zach115th/toolshellfinderScans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771
lethal-forensics/collect-memorydumpAutomated PowerShell script for forensically sound Windows memory acquisition, including crash/raw dumps, pagefile collection, triage artifacts, and…
gmh5225/zeropointThis PowerShell script detects indicators of compromise for CVE-2025-53770 — a critical RCE vulnerability in Microsoft SharePoint. Created by…
joeavanzato/trawlerPowerShell script helping Incident Responders discover potential adversary persistence mechanisms.
securityjoes/forensicminerA really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.