Tools

winsiderss/systeminformer

Real-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…

paolomonti42/salt

SALT - SLUB ALlocator Tracer for the Linux kernel

velocidex/velociraptor

Digging Deeper....

forrest-orr/moneta

Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs

mandiant/capa

Rule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…

alessandroz/lazagne

Cross-platform credential recovery tool that extracts stored passwords from browsers, email clients, databases, system mechanisms, and network…

zodiacon/alltools

All reasonably stable tools

hasherezade/pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

alex-cart/leaf

Linux Evidence Acquisition Framework

velocidex/winpmem

The multi-platform memory acquisition tool.

bughuntar/cve-2025-5777

CVE-2025-5777 Citrix NetScaler Memory Leak Exploit (CitrixBleed 2)

lem0nsec/shellghost

A memory-based evasion technique which makes shellcode invisible from process start to end.

simsong/bulk_extractor

This is the development tree. Production downloads are at:

ttffdd/xbadmanners

Tool for CVE-2018-16323

almounah/silph

Stealthy In-Memory Local Password Harvester (SILPH) tool: dump LSA, SAM and DCC2 with indirect syscall

viralmaniar/remote-desktop-caching-

This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…

google/timesketch

Collaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…

microsoft/procdump-for-linux

A Linux version of the ProcDump Sysinternals tool