
DFIR4vSphere
Powershell module for VMWare vSphere forensics

Powershell module for VMWare vSphere forensics

Zeek support for Community ID flow hashing.

OpenFPC, Open Source Full Packet Capture

A flow-based network monitor with Deep Packet Inspection

Bro analyzer that detects Google's QUIC protocol

A Zeek Wireguard protocol analyzer based on Spicy.

A Zeek OSPF packet analyzer based on Spicy.

Selective protocol extractor from PCAPs or interfaces

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those…


A tool to analyze the network flow during attack/defence Capture the Flag competitions

NetworkAssessment: Network Compromise Assessment Tool

A Zeek IPSec protocol analyzer based on Spicy.

Real-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…

Open-source network IDS/IPS/NSM engine for real-time traffic inspection, intrusion detection and prevention, protocol analysis, and rule-based threat…

Malware Configuration And Payload Extraction

Standalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…

ltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…