63,766 visible repositories in the index
1–14 of 14 · Most stars
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
ThePhish: an automated phishing email analysis tool
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
Evidence-based DSM ransomware recovery: preservation, RAM key recovery, copy decryption, and GitLab validation.
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.
Sandia Cyber Omni Tracker (SCOT)
'Packet Capture Forensic Evidence eXtractor' is a tool that finds and extracts files from packet capture files
Incident Response Triage - Windows Evidence Collection for Forensic Analysis
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.