
Loki-RS
🐍 High-performance, multi-threaded YARA & IOC scanner

🐍 High-performance, multi-threaded YARA & IOC scanner

A wireshark plugin to instrument ETW

psad: Intrusion Detection and Log Analysis with iptables

A modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral…

Automated forensic analysis tool for Google Workspace audit logs. Acquires all log types, maps events to MITRE ATT&CK Cloud Framework, and identifies…

Event Trace Log file parser in pure Python

PowerShell module for Office 365 and Azure log collection

ETW and WPP tracing tool for security research. Subscribes to multiple providers, auto-parses events to JSON, and supports advanced filtering,…

Incident Response collection and processing scripts with automated reporting scripts

Flows-first PCAP TUI (case files, gorgeous UX). Do do do do.


SSH-based Linux incident response tool that executes diagnostic commands to collect network configs, logs, user accounts, and processes, then…

Artifact collection tool for *nix systems


PacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…

Centralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…

Detects PowerShell-based malware artifacts from event logs and performs static analysis on PowerShell scripts to identify malicious activity.

Windows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…