shoucheng3/asf__nifi_cve-2023-36542_1-22-0Automated data flow platform for processing and distributing data with built-in provenance tracking, secure configuration, and scalable pipeline…
shoucheng3/apache__nifi_cve-2022-33140_1-16-22Automated data flow processing and distribution system with secure configuration, provenance tracking, and extensible plugin architecture for…
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
r3nzsec/irflow-timelineDFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…
orlikoski/skadiCollect, Process, and Hunt with host based data from MacOS, Windows, and Linux
jamf/aftermathSwift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…
neo23x0/process-watcherA process monitoring tool that tries to detect exploitation
threathunters-io/qlogETW-based Windows process creation logger that enriches events with file hashes, signatures, and parent process details, outputting to Windows…
ostesayed/oste-web-log-analyzerOSTE WLA automate the process of analyzing web server logs with the Python Web Log Analyzer.
d3sre/intelligentprocesslifecycleThe Intelligent Process Lifecycle of Active Cyber Defenders
agent-hellboy/ltmltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…
0xmfbk/ebpf-container-escape-frameworkAudit only eBPF EDR for Linux 5.15+ LTS: 14 kernel hooks, 15 actions (13 MITRE techniques), process lineage, SIEM export, K8s/Docker ready.
dereeqw/berrysentinelBerry Sentinel v5.0 — Advanced behavioral C2 and reverse shell detector for Linux/Windows/Unix systems. Features real-time connection analysis,…
sentinelblue/cve-2022-29072** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the…
1-bit-wonder/kestrelSingle-host runtime-security dashboard on eBPF — Go agent + SvelteKit. Live process tree, network map, and rule-based alerts for plain Linux hosts.
fabianch20/soc335---cve-2024-49138-exploitation-detectedSOC335 incident response walkthrough for CVE-2024-49138 CLFS privilege escalation, covering alert triage, threat intel enrichment, process tree…
eclipsemanic/threatsentry-aiThreatSentry AI is an intelligent threat hunting dashboard that leverages machine learning to proactively identify and prioritize risks in your…
garethmsheldon/cve-2025-60787-detection-motioneye-rce-via-config-injectionDetection rules and YARA/KQL signatures for CVE-2025-60787, an unauthenticated RCE in motionEye via config injection, with process execution and file…
