CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
Repository Index
47,133 repositories indexed
97–120 of 179 · Most stars
Tiny hashing module that uses the native crypto API in Node.js and the browser
WinDBG Anti-RootKit Extension
- kernel-mode
- c-plus-plus
- malware
- malware-analysis
Linker/Compiler/Tool detector for Windows, Linux and MacOS.
- detect
- reverse-engineering
- signature
- malware-analysis
An implementation of JOSE standards (JWE, JWS, JWT) in Go
honeyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS Lambda and Amazon API Gateway
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
A secure password manager for macOS,Linux and Windows platforms
Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux
DNS Rebinding Exploitation Framework
:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js
- malware-samples
- wscript
- deobfuscation
- angler
Forensics artefact collection tool for systems running Microsoft Windows
- dfir
- incident-response
- collection
⛽️ Integrates Guzzle 6.x, a PHP HTTP Client, into Symfony
- guzzle
- symfony
- php
- bundle
Drltrace is a library calls tracer for Windows and Linux applications.
- dbi
- malware-analysis
- malware-detection
- api-trace
Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools
Delphi Detours Library
- hooks
- detours
- x86-64
- windows
HIBA is a system built on top of regular OpenSSH certificate-based authentication that allows to manage flexible authorization of principals on pools of target hosts without the need to push customized authorized_users files periodically.
🗜️ A packer for Windows x86 executable files written in C and Intel x86 Assembly. The new file after packing can obstruct reverse engineering（使用C和Intel x86汇编开发的Windows x86可执行文件打包工具，打包后的新文件可以阻碍逆向工程）
Astral-PE is a low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64)
- cybersecurity
- hacktoberfest
- low-level
- mutator
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
Don't Roll Your Own Crypto: fast, type-safe, pure-Rust cryptography with post-quantum support
- libsodium
- crypto
- rust
- cryptography