circl/factual-rules-generatorGenerates YARA rules from installed software on a running OS to baseline known software and find similar installations across digital forensic…
adrecon/adreconPowerShell tool that extracts Active Directory artifacts via LDAP or ADWS and generates Excel reports for auditing, DFIR, and penetration testing.
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
intelowlproject/intelowlScalable threat intelligence platform that enriches observables and files using 200+ analyzers, with built-in GUI, REST API, and automated workflows…
tclahr/uacPortable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…
olafhartong/attackdatamapA datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
olafhartong/threathuntingA Splunk app mapped to MITRE ATT&CK to guide your threat hunts
stanfrbd/cyberbroA simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
ryandfir/hindsightBrowser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
abdulrhmanalfaifi/fennecArtifact collection tool for *nix systems
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
pedramamini/iocextractDefanged Indicator of Compromise (IOC) Extractor.
dfir-orc/dfir-orcForensics artefact collection tool for systems running Microsoft Windows
sevagas/swap_diggerAutomates Linux swap analysis to extract user credentials, web form data, WiFi keys, and HTTP authentication during post-exploitation or forensic…
edoardogerosa/pockintA portable OSINT Swiss Army Knife for DFIR/OSINT professionals 🕵️ 🕵️ 🕵️