An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.
- infosec
- infosec-reference
- reverse-engineering
- hacking
Repository Index
47,133 repositories indexed
1–16 of 16 · Most stars
Linux Runtime Security and Forensics using eBPF
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
- sleuthkit
- tct
- ntfs
- forensics
PcapPlusPlus is a multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use. It provides C++ wrappers for the most popular packet processing engines such as libpcap, Npcap, WinPcap, DPDK, AF_XDP, WinDivert and PF_RING.
- pf-ring
- dpdk
- packet-parsing
- winpcap
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
Process-aware, eBPF-based tcpdump
- ebpf
- ebpf-tc
- tcpdump
- tcpdump-like
AVML - Acquire Volatile Memory for Linux
- rust
- memory-forensics
- linux-security
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
WinDBG Anti-RootKit Extension
- kernel-mode
- c-plus-plus
- malware
- malware-analysis
Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
A Linux packet crafting tool.
- packet-crafting
- networking
- hacking-tool
- intrusion-prevention
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
- forensics
- hypervisor
- memory-dump
- reverse-engineering
Memory acquisition for Linux that makes sense.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.