
Hodometer
A single-file native Windows tray application (C, Win32, no runtime) that shows exactly which program is sending and receiving bytes and to which…

A single-file native Windows tray application (C, Win32, no runtime) that shows exactly which program is sending and receiving bytes and to which…

A process monitoring tool that tries to detect exploitation

Blazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.

This repository serves as a place for community created Targets and Modules for use with KAPE.

Automates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.

Mapping Corelight or Zeek data to Elastic Common Schema logs

Mapping Corelight or Zeek data to Elastic Common Schema fields

Provides BigFix Fixlets and analyses to detect Log4j vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) across Windows and Linux…

TheLightScope

A wireshark plugin to instrument ETW

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs