Free, open-source check for traces of mercenary spyware (Pegasus, Predator, Graphite, Candiru and more) on computers, Android phones and iPhone backups. Double-click apps for Windows, Mac and Linux, in 27 languages.
Repository Index
57,138 visible repositories in the index
1–20 of 20 · Most stars
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
- forensics
- hypervisor
- memory-dump
- reverse-engineering
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
Incident Response Triage - Windows Evidence Collection for Forensic Analysis
Command line utility and Python package to ease the (un)mounting of forensic disk images
Autonomous DFIR agent: point it at disk images, memory dumps or log exports and get back an investigation that shows its work. Volatility 3, Plaso, YARA and any OpenAI-compatible LLM.
acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.
御枢 · AegisOps — AI 安全运营工作台：告警研判、应急响应、漏洞整改，连接 Atlas、模型、工具与工作流。
- ai-agents
- secops
- security-operations
- vulnerability-management
The repository host gives no description.
The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.
- acquisition
- cybersecurity
- forensics
- iscsi
A tool to extract local data storage of an Android application in one click.
- android-extract
- android
- storage
- security-tools