Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.
- chrome
- macos
- windows
- pentest-tool
Repository Index
47,133 repositories indexed
1–24 of 25 · Most stars
Volatility 3.0 development
- digital-investigation
- forensics
- incident-response
- malware
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
- sleuthkit
- tct
- ntfs
- forensics
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
Collaborative Incident Response platform
- forensic
- incident-response
- csirt-tooling
- python
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
ThePhish: an automated phishing email analysis tool
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
- digital-security
- forensics
- incident-response
- ioc
Digital Forensics Investigation Platform
- dfir
- security
- incident-response
- artifacts
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
Forensics artefact collection tool for systems running Microsoft Windows
- dfir
- incident-response
- collection
Cyber Incident Response Team Playbook Battle Cards
- playbook-battle-cards
- cybersecurity
- cyber-threats
- cyber-security-team
We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.
- cybersecurity
- cybersecurity-tools
- incident-response
- security
Incident Response - Fast suspicious file finder
- dfir
- investigation
- incident-response
- threat-hunting
Sandia Cyber Omni Tracker (SCOT)
- perl
- javascript
- cyber-security
- incident-response
simple YARA-based IOC scanner
- yara
- ioc
- security
- incident-response
Invoke-LiveResponse
- ir
- dfir
- winrm
- liveresponse
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.
- powershell
- powershell-modules
- incident-response
- containment