ADRecon
adrecon/adreconPowerShell tool that extracts Active Directory artifacts via LDAP or ADWS and generates Excel reports for auditing, DFIR, and penetration testing.
defensive-toolsdigital-forensicsincident-response+6
adrecon/adreconPowerShell tool that extracts Active Directory artifacts via LDAP or ADWS and generates Excel reports for auditing, DFIR, and penetration testing.
talha-nazeef-ahmed/alpc-enumeratorA Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.
dfir-orc/dfir-orcForensics artefact collection tool for systems running Microsoft Windows
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
zerobytesecure/cve-2019-19781Repository documenting CVE-2019-19781 with a scanner, honeypot, and DFIR notes for Citrix ADC vulnerability detection and incident response.
stanfrbd/cyberbroA simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
intelowlproject/intelowlScalable threat intelligence platform that enriches observables and files using 200+ analyzers, with built-in GUI, REST API, and automated workflows…
sevagas/swap_diggerAutomates Linux swap analysis to extract user credentials, web form data, WiFi keys, and HTTP authentication during post-exploitation or forensic…
olafhartong/threathuntingA Splunk app mapped to MITRE ATT&CK to guide your threat hunts
olafhartong/attackdatamapA datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
edoardogerosa/pockintA portable OSINT Swiss Army Knife for DFIR/OSINT professionals 🕵️ 🕵️ 🕵️
pedramamini/iocextractDefanged Indicator of Compromise (IOC) Extractor.
ryandfir/hindsightBrowser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
circl/factual-rules-generatorGenerates YARA rules from installed software on a running OS to baseline known software and find similar installations across digital forensic…