Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
- digital-security
- forensics
- incident-response
- ioc
Repository Index
47,133 repositories indexed
25–48 of 55 · Most stars
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
- dfir
- dissect
- python
AVML - Acquire Volatile Memory for Linux
- rust
- memory-forensics
- linux-security
macOS (& ios) Artifact Parsing Tool
Digital Forensics Investigation Platform
- dfir
- security
- incident-response
- artifacts
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
Dynamic unpacker based on PE-sieve
- libpeconv
- pe-sieve
- memory-forensics
- malware-unpacker
WinDBG Anti-RootKit Extension
- kernel-mode
- c-plus-plus
- malware
- malware-analysis
:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
Volatility plugin for extracts configuration data of known malware
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
Remote forensics meta tool
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
A Linux packet crafting tool.
- packet-crafting
- networking
- hacking-tool
- intrusion-prevention
Forensics artefact collection tool for systems running Microsoft Windows
- dfir
- incident-response
- collection
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
- forensics
- hypervisor
- memory-dump
- reverse-engineering
Web interface for the Volatility Memory Forensics Framework
Memory acquisition for Linux that makes sense.
The repository host gives no description.
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
Merge multiple pcap files together, gracefully.
- pcap
- merge
- tcpdump-capture
- packet-processing
Invoke-LiveResponse
- ir
- dfir
- winrm
- liveresponse
Digital Forensics Artifacts Knowledge Base