MemGuard
prox0959/memguardZero-dependency Windows EDR utility that detects and mitigates unauthorized LSASS memory access, handle duplication, and LOLBin credential dumping in…
defensive-toolsdigital-forensicsincident-response+4
prox0959/memguardZero-dependency Windows EDR utility that detects and mitigates unauthorized LSASS memory access, handle duplication, and LOLBin credential dumping in…
prox0959/cryptoclipguardReal-time Windows clipboard hijack detector that monitors clipboard changes, restores replaced BTC, ETH, SOL, and USDT addresses, and alerts users to…
mohamedbrek/soc335-cve-2024-49138-exploitation-detectedLetsDefend SOC lab investigating CVE-2024-49138 and related malicious activity.
basitsajidsoc/soc-investigation-cve-2024-49138Investigation and Incident Response report for LetsDefend Alert SOC335 (CVE-2024-49138 Exploitation)
ethan-andrews/threatintel-aggregatorSelf-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineering. Runs…
fevar54/cve-2026-76461-detection-kit-Defensive detection kit for CVE-2026-76461, a critical SQL injection in Cisco Secure Email Gateway, with Sigma and YARA rules, IOCs, and remediation…
karim852/kage-dfir-toolkitWindows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…
falconforceteam/falcondashAzure workbook dashboard that visualizes and explores detection performance metrics, helping security teams measure and proactively maintain their…
meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
mgreen27/detectraptorA repository to share publicly available Velociraptor detection content
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
0x0allenace/soc-analyst-portfolioA curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
wattocyber/masqLive recon and posture auditing for AI agent infrastructure: scans MCP configs, session logs, and APIs for secrets, poisoned catalogs, and CoT leaks.
kevin9480/security_incident_reportReact2Shell(CVE-2025-55182) 취약점 기반 침해 시나리오를 재현하고, Wazuh/Sysmon/Coraza WAF 로그로 침해사고를 분석·대응한 DFIR 프로젝트
c3rb3ru5d3d53c/signaturesCommunity Detection Signature Build and Distribution Pipeline for YARA, Suricata, Snort and Sigma
xephora/threat-remediation-scriptsThis repository contains a list of new remediation scripts.