Security sensor for realtime threat detection and protection
Repository Index
47,133 repositories indexed
1–24 of 25 · Most stars
Super timeline all the things
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
A network sniffer that logs all DNS server replies for use in a passive DNS setup
Collaborative Incident Response platform
- forensic
- incident-response
- csirt-tooling
- python
PowerForensics provides an all in one platform for live disk forensic analysis
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
- digital-security
- forensics
- incident-response
- ioc
Digital Forensics Investigation Platform
- dfir
- security
- incident-response
- artifacts
WinDBG Anti-RootKit Extension
- kernel-mode
- c-plus-plus
- malware
- malware-analysis
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
Volatility plugin for extracts configuration data of known malware
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
Cyber Incident Response Team Playbook Battle Cards
- playbook-battle-cards
- cybersecurity
- cyber-threats
- cyber-security-team
$MFT directory tree reconstruction & FILE record info
- mft-browser
- mft
- powershell
- winform
ROPMEMU is a framework to analyze, dissect and decompile complex code-reuse attacks.
VolatilityBot – An automated memory analyzer for malware samples and memory dumps
Sandia Cyber Omni Tracker (SCOT)
- perl
- javascript
- cyber-security
- incident-response
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
simple YARA-based IOC scanner
- yara
- ioc
- security
- incident-response
Open-source cross-platform defensive spyware, stalkerware and surveillance software detector
Cross-platform, open-source shellbag parser
The repository host gives no description.
Based on the Volatility framework, this script will run various plugins as well as create a timeline, or use YARA/ClamAV/VirusTotal to find badness.