zeek-netsupport-detector
corelight/zeek-netsupport-detectorA Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.
command-and-controldefensive-toolsintrusion-detection+3
2
corelight/zeek-netsupport-detectorA Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
kirkdjohnson/wiresharkDownloaded a packet capture (.pcapng) file from malware-traffic-analysis.net which was an example of an attempted attack against a webserver using…
aelshimony-cloud/openwire-cve-2023-46604-investigationIncident response walkthrough analyzing CVE-2023-46604 exploitation of Apache ActiveMQ via OpenWire, including PCAP analysis, IOC identification, and…
jhatchi/nexacorp-dfir-inc-2026-001DFIR investigation + 7 Suricata rules on a simulated NexaCorp intrusion (vsftpd 2.3.4 CVE-2011-2523 + MITRE Caldera C2). 4-day solo engagement…
zedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitationIncident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check…
blackoclock/xls-to-dbatloader-or-guloader-for-agenttesla-variantCVE-2017-0199 XLS --> HTA --> VBS --> STEGANOGRAPHY --> DBATLOADER/GULOADER STYLE MALWARE
suyash-r-k/dfir-malware-investigationSpring4Shell (CVE-2022-22965) DFIR lab with exploit simulation, Python WAF, IOC-based detection, and PCAP analysis.
camp0/aiengineAIEngine is a next generation interactive/programmable Python/Ruby/Java/Lua and Go NIDS (Network intrusion detection system).
gilberto47831/network-filesystem-forensicsReports on post-exploitation on honeypot exploiting vulnerable wu-ftpd (CVE-2001-0550)
capesandbox/capesoloStandalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…
agent-hellboy/ltmltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…
kevoreilly/capev2Malware Configuration And Payload Extraction
frankwxu/digital-forensics-labFree hands-on digital forensics labs for students and faculty
gosecure/pyrdpRDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact
benjeems/packetstriderA network packet forensics tool for SSH
kybr-git/dc30-badge-challenge-writeupWriteup for the DEF CON 30 badge challenge
alzeaty1/security-writeupsCTF writeups and teaching scripts for web security, bug bounty techniques, and network forensics, with blank-value versions for active practice.