Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.
- chrome
- macos
- windows
- pentest-tool
Repository Index
47,133 repositories indexed
1–24 of 26 · Most stars
Collaborative forensic timeline analysis
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
- sleuthkit
- tct
- ntfs
- forensics
Super timeline all the things
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
A network sniffer that logs all DNS server replies for use in a passive DNS setup
Collaborative Incident Response platform
- forensic
- incident-response
- csirt-tooling
- python
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
AVML - Acquire Volatile Memory for Linux
- rust
- memory-forensics
- linux-security
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
A framework for orchestrating forensic collection, processing and data export
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
Python installable command line utiltity for mitigation of host and key compromises.
Script for automating Linux memory capture and analysis
Memory acquisition for Linux that makes sense.
Command line access to the Registry
simple YARA-based IOC scanner
- yara
- ioc
- security
- incident-response
The repository host gives no description.
Command line utility and Python package to ease the (un)mounting of forensic disk images
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.