androidqf
mvt-project/androidqfandroidqf (Android Quick Forensics) helps quickly gathering forensic evidence from Android devices, in order to identify potential traces of…
android-securitydata-recoverydigital-forensics+4
325
mvt-project/androidqfandroidqf (Android Quick Forensics) helps quickly gathering forensic evidence from Android devices, in order to identify potential traces of…
rapticore/orenpmguardDefense Against the Shai-Hulud Supply Chain Attack
cloudflare/mitmengineA MITM (monster-in-the-middle) detection tool. Used to build MALCOLM:
go-lanz/persistnuxBash-based Linux persistence detection tool for DFIR investigations. Scans 15+ persistence mechanisms (systemd, cron, kernel modules, SSH,…
grahamhelton/imdspoofIMDSPOOF is a cyber deception tool that spoofs the AWS IMDS service to return HoneyTokens that can be alerted on.
rulebricks/claude-code-guardrailsReal-time guardrails for Claude Code tool calls.
botherder/androidqfPortable forensic acquisition tool for Android devices that collects relevant data via USB debugging to identify potential spyware or compromise…
digital-dev/log4j-cve-2021-44228-remediationThis powershell script is intended to be used by anyone looking to remediate the Log4j Vulnerability within their environment. It can target multiple…
sap8899/reportlyAzureAD/EntraID user activity reporter for blue teams. Input a suspicious user and time frame to receive a detailed report of user info, actions, and…
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
bi8d0/driversentinelDriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them against the…
purp1ew0lf/blue-team-notesYou didn't think I'd go and leave the blue team out, right?
gopasteverything/gpewebdefenderLightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.
thomaspoppelgaard/netscaler-ctx697096-checkerRead-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778): verifies build, CVE preconditions and upgrade risks, and sweeps public IoCs…
perplexityai/bumblebeeRead-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software…
gosecure/pyrdpRDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact