
so-crates
SO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!

SO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

'Packet Capture Forensic Evidence eXtractor' is a tool that finds and extracts files from packet capture files

Wireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…

PacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…

A swiss-knife MCP server for analysing PCAP files

Decodes PlugX traffic and encrypted/compressed artifacts

Lua plugin to extract data from Wireshark and convert it into MISP format

Decrypts Covenant C2 communications by extracting RSA private keys from minidumps, recovering AES session keys, and converting network captures to…

A tool to assist with network-based hunting for GRU's Drovorub malware c2

A python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security…

A collection of scripts for processing network forensics type data and intelligence, mainly into a postgres database.

End-to-end simulation of a Python dependency confusion attack, sudo privilege escalation (CVE-2025-32463), and rootkit-based persistence - with full…

This framework combines a set of existing open source tools into an integrated package that automates the forensics investigation process. It is able…

LetsDefend SOC lab investigating CVE-2024-49138 exploitation and related malicious activity.

Downloaded a packet capture (.pcapng) file from malware-traffic-analysis.net which was an example of an attempted attack against a webserver using…