
ir-rescue
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those…

Dshell is a network forensic analysis framework.

PacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…

Wireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…

Automation tool designed to simplify the analysis of PCAP (Packet Capture) files

A tool for processing a lot of pcaps using tshark

The Multiplatform Linux Sandbox

AIEngine is a next generation interactive/programmable Python/Ruby/Java/Lua and Go NIDS (Network intrusion detection system).

You didn't think I'd go and leave the blue team out, right?

Malware samples, analysis exercises and other interesting resources.

Hands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…

It was developed to speed up the processes of SOC Analysts during analysis

Decrypts Covenant C2 communications by extracting RSA private keys from minidumps, recovering AES session keys, and converting network captures to…

A network packet forensics tool for SSH

create cypher create statements for neo4j out of netstat files from multiple machines

JA4+ is a suite of network fingerprinting standards

Malcom - Malware Communications Analyzer