Repository Index

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

• forensics
• mobile
• security
• android

OS X Auditor is a free Mac OS X computer forensics tool

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte

• incident-response
• malware-detection
• persistence
• powershell

detect stegano-hidden data in PNG & BMP

UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.

• incident-response
• forensics
• computer-forensics
• triage

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

• digital-security
• forensics
• incident-response
• ioc

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft

Python installable command line utiltity for mitigation of host and key compromises.

inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

• forensics
• hypervisor
• memory-dump
• reverse-engineering

Automatically exported from code.google.com/p/creddump

ROPMEMU is a framework to analyze, dissect and decompile complex code-reuse attacks.

The Volatility Collaborative GUI

• volatility-gui
• volatility-framework
• volatility
• memory-dump

VolatilityBot – An automated memory analyzer for malware samples and memory dumps

Memory acquisition for Linux that makes sense.

"Evolving AppCompat/AmCache data analysis beyond grep"

simple YARA-based IOC scanner

• yara
• ioc
• security
• incident-response

Tools for the Computer Incident Response Team :computer:

• dfir
• python
• carbonblack
• malware-analysis

Tool used for dumping memory from Android devices