0x0allenace/soc-analyst-portfolioA curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…
diogo-fernan/ir-rescueA Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
jpcertcc/logontracerInvestigate malicious Windows logon by visualizing and analyzing Windows event log
yampelo/beagleBeagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
omerbenamram/evtxA Fast (and safe) parser for the Windows XML Event Log (EVTX) format
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
adham504/sentinelthread-forensicsHigh-speed Windows forensic triage platform that orchestrates the Hayabusa engine to transform raw EVTX logs into prioritized threat timelines with…
shellkraft/ledgerAn aggressor script that tracks operational changes made during a red team engagement. Gives you a full audit trail of what was changed and what…
dereeqw/berrysentinelBerry Sentinel v5.0 — Advanced behavioral C2 and reverse shell detector for Linux/Windows/Unix systems. Features real-time connection analysis,…
silverfort-open-source/latmaCollects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…
synacktiv/forensic-msvpnThis repository contains Velociraptor artifact and Chainsaw rules to help detect Microsoft Remote Access VPN activity
abrignoni/aleappAndroid Logs Events And Protobuf Parser
cisagov/untitledgoosetoolUntitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to…
