MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Repository Index
47,133 repositories indexed
1–23 of 23 · Most stars
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
- sleuthkit
- tct
- ntfs
- forensics
Security sensor for realtime threat detection and protection
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
Collaborative Incident Response platform
- forensic
- incident-response
- csirt-tooling
- python
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
- dfir
- dissect
- python
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
Incident Response Forensic Framework
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.
- cybersecurity
- cybersecurity-tools
- incident-response
- security
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
Open-source cross-platform defensive spyware, stalkerware and surveillance software detector
Follow stolen crypto hop by hop across Bitcoin, Ethereum, TRON, BNB Chain and Solana. Labels where the money landed, keeps proof for every clue, writes the report.
Tools for the Computer Incident Response Team :computer:
- dfir
- python
- carbonblack
- malware-analysis
The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange.
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
A tool designed for consistent and safe capture of off network web resources.
- network-defense
- security-tools
🕵️♀️ Find, locate, and query files for ops and security experts ⚡️⚡️⚡️
A tool to extract local data storage of an Android application in one click.
- android-extract
- android
- storage
- security-tools