lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
r3nzsec/irflow-timelineDFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…
orlikoski/skadiCollect, Process, and Hunt with host based data from MacOS, Windows, and Linux
jamf/aftermathSwift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…
threathunters-io/qlogETW-based Windows process creation logger that enriches events with file hashes, signatures, and parent process details, outputting to Windows…
ostesayed/oste-web-log-analyzerOSTE WLA automate the process of analyzing web server logs with the Python Web Log Analyzer.
d3sre/intelligentprocesslifecycleThe Intelligent Process Lifecycle of Active Cyber Defenders
agent-hellboy/ltmltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…
dereeqw/berrysentinelBerry Sentinel v5.0 — Advanced behavioral C2 and reverse shell detector for Linux/Windows/Unix systems. Features real-time connection analysis,…
fabianch20/soc335---cve-2024-49138-exploitation-detectedSOC335 incident response walkthrough for CVE-2024-49138 CLFS privilege escalation, covering alert triage, threat intel enrichment, process tree…
sentinelblue/cve-2022-29072** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the…
1-bit-wonder/kestrelSingle-host runtime-security dashboard on eBPF — Go agent + SvelteKit. Live process tree, network map, and rule-based alerts for plain Linux hosts.
eclipsemanic/threatsentry-aiThreatSentry AI is an intelligent threat hunting dashboard that leverages machine learning to proactively identify and prioritize risks in your…
m2l33k/blockguardBlockGuard is a Windows Data Loss Prevention (DLP) agent that intercepts and controls file access at the process level. It ensures that only…
garethmsheldon/cve-2025-60787-detection-motioneye-rce-via-config-injectionDetection rules and YARA/KQL signatures for CVE-2025-60787, an unauthenticated RCE in motionEye via config injection, with process execution and file…
mrezqi/cve-2021-1675_carbonblack_huntingqueryCarbonBlack hunting queries to detect PrintNightmare (CVE-2021-1675) exploitation via file, module load, and process events, based on Sigma rules.
ernestak/sigma-rule-for-cve-2022-30190Sigma rule for detecting exploitation of CVE-2022-30190 (Follina) via Windows process creation events, enabling SOC teams to identify malicious…
domcyrus/rustnetPer-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.
