ADRecon
adrecon/adreconPowerShell tool that extracts Active Directory artifacts via LDAP or ADWS and generates Excel reports for auditing, DFIR, and penetration testing.
defensive-toolsdigital-forensicsincident-response+6
990
adrecon/adreconPowerShell tool that extracts Active Directory artifacts via LDAP or ADWS and generates Excel reports for auditing, DFIR, and penetration testing.
jaksi/sshesameAn easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
emrekybs/douglas-042Triages a suspect Windows machine in minutes. Collects processes, services, autoruns, event logs and forensic artifacts, flags attacker activity, and…
qazeer/farsightadPowerShell script that aim to help uncovering (eventual) persistence mechanisms deployed by a threat actor following an Active Directory domain…
silverfort-open-source/latmaCollects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…
abdaullahag/threatlensPython CLI tool for rapid IOC analysis (IPs, Domains, CVEs) using 6 free Threat Intel APIs. Outputs: Color-coded Excel, JSON, CSV. Uses: VT, Shodan,…
zephrfish/cve-2025-53770-scannerToolShell scanner - CVE-2025-53770 and detection information
yossisassi/zerologon-exploitation-checkquick'n'dirty automated checks for potential exploitation of CVE-2020-1472 (aka ZeroLogon), using leading artifects in determining an actual…
vulncheck-oss/fetch-broker-confA go-exploit for fetching the RocketMQ broker configuration in order to discover indicators of compromise for CVE-2023-33246
wadesweaponshed/cve-2026-93616_checksShell and SmartDashboard scripts that check Check Point management servers for indicators of compromise tied to CVE-2026-93616, including rogue…
josephgodwinkimani/cloudpanel-2.4.2-cve-2024-44765-recoveryHow to "recover" a CloudPanel server affected by the CVE-2024-44765 vulnerability
tadash10/detect-cve-2024-0762Detecting vulnerabilities like CVE-2024-0762, particularly in UEFI firmware, is quite challenging due to the low-level nature
foospidy/honeypyA low to medium interaction honeypot.
g0tmi1k/kippo-g0tmi1kMedium-interaction SSH honeypot that logs brute force attacks and full attacker shell interactions, with customization options to reduce…
shadowguardai/ti-a-ti-cveexploitcheckerDetermines if public exploits are available for a given CVE. Uses APIs like exploit-db or NVD to ide
cowrie/cowrieCowrie SSH/Telnet Honeypot https://docs.cowrie.org/
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine