Repository Index

Dshell is a network forensic analysis framework.

Collaborative forensic timeline analysis

• forensics
• dfir
• security
• timeline

Network Analysis Tool

• hacking
• pcap-files
• pcap
• cyber

Collaborative Incident Response platform

• forensic
• incident-response
• csirt-tooling
• python

PowerForensics provides an all in one platform for live disk forensic analysis

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

• forensics
• hypervisor
• memory-dump
• reverse-engineering

Script for automating Linux memory capture and analysis

Open Source SIEM (Security Information and Event Management system).

• siem
• risk-management
• risk-assessment
• vulnerability-management

"Evolving AppCompat/AmCache data analysis beyond grep"

Tools for the Computer Incident Response Team :computer:

• dfir
• python
• carbonblack
• malware-analysis

Incident Response Triage - Windows Evidence Collection for Forensic Analysis

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

• c
• forensics
• log-analysis
• security

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.

• acquisition
• cybersecurity
• forensics
• iscsi