Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Repository Index
47,133 repositories indexed
169–192 of 307 · Most stars
A secure password manager for macOS,Linux and Windows platforms
Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux
A front-end JavaScript toolkit for creating DNS rebinding attacks.
:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
Robust ABC (ActionScript Bytecode) [Dis-]Assembler
Docker Scout CLI
Forensics artefact collection tool for systems running Microsoft Windows
- dfir
- incident-response
- collection
A modern and easy-to-use cryptographic library for .NET based on libsodium
- aead
- aes-gcm
- blake2b
- chacha20-poly1305
Drltrace is a library calls tracer for Windows and Linux applications.
- dbi
- malware-analysis
- malware-detection
- api-trace
Very simple SAML 2.0 consumer module for ASP.NET/C#
- saml
- asp-net
- single-sign-on
- asp-net-mvc
DDoS attacks over Tor
- ddos
- ddos-tool
- ddos-attack
- ddos-script
Delphi Detours Library
- hooks
- detours
- x86-64
- windows
🗜️ A packer for Windows x86 executable files written in C and Intel x86 Assembly. The new file after packing can obstruct reverse engineering（使用C和Intel x86汇编开发的Windows x86可执行文件打包工具，打包后的新文件可以阻碍逆向工程）
Astral-PE is a low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64)
- cybersecurity
- hacktoberfest
- low-level
- mutator
DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.
- python
- malware-analysis
- automation
- config-dump
A plugin for Microsoft.EntityFrameworkCore to add support of encrypted fields using built-in or custom encryption providers.
- entity-framework-core
- plugin
- encryption
- netstandard
Scans for accessibility tools backdoors via RDP
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
Don't Roll Your Own Crypto: fast, type-safe, pure-Rust cryptography with post-quantum support
- libsodium
- crypto
- rust
- cryptography
A Suricata Docker image.
- suricata
- ids
- nsm
- docker
A production-ready SaaS template built with Next.js 15, Supabase, and Tailwind CSS. Includes authentication, user management, file storage, task management demos, and secure RLS policies. Now with a complete React Native + Expo mobile app template! Easily customizable with pre-built themes, i18n support (EN/PL/ZH), and legal documents.