
irflow-timeline
DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…
digital-forensicsdisk-forensicsforensics+7
360

DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…

Hunts out CobaltStrike beacons and logs operator command output

truffleproc — hunt secrets in process memory (TruffleHog & gdb mashup)

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.