plex2shell_pcap
boredhackerblog/plex2shell_pcapPacket capture artifacts of plex2shell exploitation against Plex, including lab and in-the-wild traffic, for building and validating detection…
exploitationincident-responsenetwork-forensics+3
boredhackerblog/plex2shell_pcapPacket capture artifacts of plex2shell exploitation against Plex, including lab and in-the-wild traffic, for building and validating detection…
ahmed-tarek22752/security-vulnerability-in-microsoft-office.Blue-team analysis of a malicious DOCX exploiting CVE-2017-0199, covering sandbox detonation, network forensics, IOC extraction, MITRE ATT&CK…
microlaser/dns_watchdog_windows2PowerShell script that monitors Windows DNS traffic via pktmon to detect poisoning, spoofing, rogue resolver responses, and gateway MAC changes,…
capesandbox/capesoloStandalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
google/gopacketProvides packet processing capabilities for Go
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
purp1ew0lf/blue-team-notesYou didn't think I'd go and leave the blue team out, right?
naacbin/covenantdecryptorDecrypts Covenant C2 communications by extracting RSA private keys from minidumps, recovering AES session keys, and converting network captures to…
jstrosch/malware-samplesMalware samples, analysis exercises and other interesting resources.
p1sec/qcsuperQCSuper is a tool communicating with Qualcomm-based phones and modems, allowing to capture raw 2G/3G/4G radio frames, among other things.
cyberhatcoil/acfAndroid Connections Forensics
nccgroup/baskervilleSelective protocol extractor from PCAPs or interfaces
nccgroup/pcap-burpPcap importer for Burp
knqyf263/ndffA flow-based network monitor with Deep Packet Inspection
corelight/corelightforsplunkSplunk app for integrating and analyzing Corelight network detection data, enabling real-time threat hunting and incident response.