1.mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
+3,457 stars
from 12,302 · score 8.15
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
19 repositories by Attention Score · May 10, 2026 – Nov 5, 2026 (UTC)
2.Velocidex / velociraptor
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
- endpoint-protection
- endpoint-discovery
- +1 more
+500 stars
from 3,918 · score 6.22
3.volatilityfoundation / volatility3
Volatility 3.0 development
- digital-investigation
- forensics
- incident-response
- malware
- memory
- python
- +3 more
+496 stars
from 4,075 · score 6.21
4.JPCERTCC / LogonTracer
Investigate malicious Windows logon by visualizing and analyzing Windows event log
- security
- dfir
- javascript
- visualization
- active-directory
- event-log
- +2 more
+145 stars
from 3,155 · score 4.98
5.rabbitstack / fibratus
Security sensor for realtime threat detection and protection
+116 stars
from 2,451 · score 4.76
6.simsong / bulk_extractor
This is the development tree. Production downloads are at:
+86 stars
from 1,356 · score 4.47
7.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
- detection
- auditd
- +9 more
+69 stars
from 804 · score 4.25
8.last-byte / PersistenceSniper
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
- powershell-module
- powershell-script
- +3 more
+51 stars
from 2,101 · score 3.95
9.USArmyResearchLab / Dshell
Dshell is a network forensic analysis framework.
+34 stars
from 5,474 · score 3.56
+31 stars
from 694 · score 3.47
11.p0w3rsh3ll / AutoRuns
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
+16 stars
from 292 · score 2.83
12.gamelinux / passivedns
A network sniffer that logs all DNS server replies for use in a passive DNS setup
+7 stars
from 1,730 · score 2.08
13.dfirtrack / dfirtrack
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
- incident-management
+7 stars
from 533 · score 2.08
14.codeyourweb / fastfinder
Incident Response - Fast suspicious file finder
- dfir
- investigation
- incident-response
- threat-hunting
+6 stars
from 255 · score 1.95
15.YelpArchive / osxcollectorArchived
A forensic evidence collection & analysis toolkit for OS X
+4 stars
from 1,885 · score 1.61
16.jipegit / OSXAuditor
OS X Auditor is a free Mac OS X computer forensics tool
+3 stars
from 3,125 · score 1.39
17.JPCERTCC / MalConfScan
Volatility plugin for extracts configuration data of known malware
+3 stars
from 495 · score 1.39
18.JPCERTCC / SysmonSearch
Investigate suspicious activity by visualizing Sysmon's event log
- security
- kibana
- elasticsearch
- sysmon
- stix
- stix2
+3 stars
from 429 · score 1.39
19.swwwolf / wdbgark
WinDBG Anti-RootKit Extension
- kernel-mode
- c-plus-plus
- malware
- malware-analysis
- malware-research
- forensic-analysis
- +14 more
+2 stars
from 640 · score 1.10