Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.
Repository Index
47,133 repositories indexed
1–22 of 22 · Most stars
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
- sleuthkit
- tct
- ntfs
- forensics
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
A Powershell incident response framework
Collaborative Incident Response platform
- forensic
- incident-response
- csirt-tooling
- python
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
Scriptable, multipurpose mock server. Run standalone mock servers, or embed mocks within your tests or CI/CD pipeline.
Python installable command line utiltity for mitigation of host and key compromises.
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
Russian text quality for AI agents — neuroslop cleanup, typography, information style, editorial standards, UX writing, business correspondence. Scores text 0–10. 2,000+ linguistic atoms.
- claude-code
- editorial
- russian
- typography
RTS: request to struct. Generates Go structs from JSON server responses.
- rts
- json-server
- cli
- json
A trusty CLI companion to monitor file changes and automatically run the corresponding Ruby specs. Ready to assist on any Ruby project, no setup needed!
- ruby
- cli
- file-changes
- refactoring
Invoke-LiveResponse
- ir
- dfir
- winrm
- liveresponse
Commandline interface in browser for Symfony2
- symfony
- php
- bundle
- symfony-bundle
WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.
PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.
- powershell
- powershell-modules
- incident-response
- containment
🫠 Your MacBook has feelings. Every hardware event triggers a personality response.
- accelerometer
- apple-silicon
- cli
- fun