meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
mushorg/buttinskyBotnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open…
navytitanium/eitest-tools-scripts-iocsIOC feed and analysis toolkit for EITest campaigns, featuring C2 data decryption, victim payload decoding, and sinkhole log processing for threat…
exptechtw/cve-2025-66478Real-world attack log analysis of CVE-2025-66478 (Next.js Server Actions RCE) with malware samples, attacker IP tracking, and container security…
dougburks/so-cratesSO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…
abc1230940/soc336-windows-ole-zero-click-rce-exploitation-detected-cve-2025-21298SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough
mxmssh/drltraceDrltrace is a library calls tracer for Windows and Linux applications.
cowrie/cowrieCowrie SSH/Telnet Honeypot https://docs.cowrie.org/
sh1n0g1/z9Detects PowerShell-based malware artifacts from event logs and performs static analysis on PowerShell scripts to identify malicious activity.
