awesome-lists
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
curated-resourcesdigital-forensicseducation+4
1.9k
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
ry-allan/tanstack-compromise-checkerDetects CVE-2026-45321 (TanStack supply chain compromise) and Mini Shai-Hulud worm artifacts. Scans node_modules, lockfiles, persistence hooks…
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
inquest/python-inquestlabsA Pythonic interface and command line tool for interacting with the InQuest Labs API.
onapsis/onapsis-mandiant-cve-2025-31324-vuln-compromise-assessmentCVE-2025-31324 & CVE-2025-42999 vulnerability and compromise assessment tool
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
concinnity-risks/ransomcoinpublicA DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries.
abhinavbom/threat-intelligence-hunterTIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea…
emalderson/thephishThePhish: an automated phishing email analysis tool
rushter/hexoraStatic analysis of malicious Python code
malpedia/malpedia-flossedFLARE floss applied to all unpacked+dumped samples in Malpedia, pre-processed for further use.
zerodayvpn/cve-2026-41089-netlogon🛡️ Official AI Security Tool diagnostic module for CVE-2026-41089 (Windows Netlogon Stack Buffer Overflow RCE). Features technical writeup, attack…
payloadsecurity/sandbox_scryerParses public sandbox detonation reports to produce threat hunting intelligence, organizes findings via MITRE ATT&CK, assembles IOCs, and generates…
packetsifter/packetsiftertoolPacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…
misp/misp-taxonomiesTaxonomies used in MISP taxonomy system and can be used by other information sharing tool.
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
onapsis/cve-2020-6287_recon-scannerBlack-box vulnerability scanner and indicator-of-compromise analyzer for CVE-2020-6287 (RECON) in SAP NetWeaver Java applications, enabling rapid…