1.OTRF / ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
+25 stars
from 4,681 · score 3.26
Trending repositories
Ranked by Attention Score: stars gained over the last 30 complete days
13 repositories by Attention Score · Oct 4, 2026 – Nov 2, 2026 (UTC)
2.RyanDFIR / hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
+23 stars
from 1,529 · score 3.18
3.google / timesketch
Collaborative forensic timeline analysis
+22 stars
from 3,426 · score 3.14
4.JPCERTCC / LogonTracer
Investigate malicious Windows logon by visualizing and analyzing Windows event log
+21 stars
from 3,278 · score 3.09
5.fox-it / dissect
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
+18 stars
from 1,161 · score 2.94
6.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
+16 stars
from 855 · score 2.83
7.ydkhatri / mac_apt
macOS (& ios) Artifact Parsing Tool
+10 stars
from 1,088 · score 2.40
8.Neo23x0 / Loki
Loki - Simple IOC and YARA Scanner
+9 stars
from 3,793 · score 2.30
9.Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
+8 stars
from 1,756 · score 2.20
10.yeti-platform / yeti
Your Everyday Threat Intelligence
+5 stars
from 2,033 · score 1.79
11.pedramamini / ThreatIngestor
Extract and aggregate threat intelligence.
+2 stars
from 930 · score 1.10
12.tomchop / malcom
Malcom - Malware Communications Analyzer
+1 stars
from 1,173 · score 0.69
13.dfirtrack / dfirtrack
DFIRTrack - The Incident Response Tracking Application
+1 stars
from 539 · score 0.69