
passivedns
A network sniffer that logs all DNS server replies for use in a passive DNS setup

A network sniffer that logs all DNS server replies for use in a passive DNS setup

PacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…

All-in-One malware analysis tool.

A network packet forensics tool for SSH

It was developed to speed up the processes of SOC Analysts during analysis

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…

Selective protocol extractor from PCAPs or interfaces

Hands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…

Standalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…

The Multiplatform Linux Sandbox

Behavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…

create cypher create statements for neo4j out of netstat files from multiple machines

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.

TCP/IP packet demultiplexer. Download from:

Zeek support for Community ID flow hashing.

A Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.

Downloaded a packet capture (.pcapng) file from malware-traffic-analysis.net which was an example of an attempted attack against a webserver using…