
zeek
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Real-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…

Utility that converts an .etl file containing a Windows network packet capture into .pcapng format.

PowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…

JA4+ is a suite of network fingerprinting standards

PowerShell script that monitors Windows DNS traffic via pktmon to detect poisoning, spoofing, rogue resolver responses, and gateway MAC changes,…

A network sniffer that logs all DNS server replies for use in a passive DNS setup


Hands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

Passive service locator, a python sniffer that identifies servers, clients, names and much more

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…

eBPF-based packet analyzer that captures network traffic with automatic process, container, and Kubernetes pod metadata annotation, supporting…

This framework combines a set of existing open source tools into an integrated package that automates the forensics investigation process. It is able…

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from…

A Zeek STUN protocol analyzer based on Spicy.

PacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…