TEx
guibacellar/texTelegram intelligence collection tool for researchers and investigators. Scrapes groups, messages, media, and user data with OCR, Elasticsearch…
digital-forensicsforensicsinformation-gathering+2
375
guibacellar/texTelegram intelligence collection tool for researchers and investigators. Scrapes groups, messages, media, and user data with OCR, Elasticsearch…
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
rjbhide/wireshark-forensics-pluginWireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…
assafmo/xiocExtract indicators of compromise from text, including "escaped" ones.
packetsifter/packetsiftertoolPacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…
concinnity-risks/ransomcoinpublicA DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries.
sh1n0g1/z9Detects PowerShell-based malware artifacts from event logs and performs static analysis on PowerShell scripts to identify malicious activity.
nccgroup/mortimerA collection of scripts for processing network forensics type data and intelligence, mainly into a postgres database.
synacktiv/synacktiv-rulesPublic repository of Sigma and YARA rules created by Synacktiv
corelight/hasshFingerprint SSH clients and servers.
aquibpro/forensix-studioForensic intelligence platform that analyzes files, correlates threat indicators, maps behavior to MITRE ATT&CK, and generates actionable security…
mikesxrs/cve-2023-21716_yara_resultsResults of retrohunt for files matching YARA rules from https://github.com/AmgdGocha/Detection-Rules/blob/main/CVE-2023-21716.yar
sherlock-project/sherlockHunt down social media accounts by username across social networks
fox-it/cisco-ios-xe-implant-detectionCisco IOS XE implant scanning & detection (CVE-2023-20198, CVE-2023-20273)
logisek/baconsamplerSniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.
navytitanium/eitest-tools-scripts-iocs
iyargross/smb-cve-2025-33073Advanced SMB Honeypot: CVE-2025-33073 Research & Implementation
cert-polska/mqueryYARA malware query accelerator (web frontend)