zedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitationIncident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check…
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
aelshimony-cloud/openwire-cve-2023-46604-investigationIncident response walkthrough analyzing CVE-2023-46604 exploitation of Apache ActiveMQ via OpenWire, including PCAP analysis, IOC identification, and…
suyash-r-k/dfir-malware-investigationSpring4Shell (CVE-2022-22965) DFIR lab with exploit simulation, Python WAF, IOC-based detection, and PCAP analysis.
security-onion-solutions/security-onionSecurity Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
deepfence/packetstreamer⭐ ⭐ Distributed tcpdump for cloud native environments ⭐ ⭐
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
omriher/captipperMalicious HTTP traffic explorer
tomchop/malcomMalcom - Malware Communications Analyzer
cristianzsh/forensictoolsCollection of forensic tools
microsoft/etl2pcapngUtility that converts an .etl file containing a Windows network packet capture into .pcapng format.
proxymanapp/tcpviewerThe best-in-class macOS app to See every packet clearly on your Mac. Alternative to Wireshark
hasamba/dfir-companionDFIR forensics companion server + capture extension
securityronin/memory-forensicWalk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
nao-sec/ramnit_traffic_parserParsing Ramnit's traffic
