1.mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
+531 stars
from 15,228 · score 6.28
Trending repositories
Ranked by Attention Score: stars gained over the last 30 complete days
13 repositories by Attention Score · Oct 7, 2026 – Nov 5, 2026 (UTC)
2.Velocidex / velociraptor
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
- endpoint-protection
- endpoint-discovery
- +1 more
+118 stars
from 4,300 · score 4.78
3.volatilityfoundation / volatility3
Volatility 3.0 development
- digital-investigation
- forensics
- incident-response
- malware
- memory
- python
- +3 more
+113 stars
from 4,458 · score 4.74
4.JPCERTCC / LogonTracer
Investigate malicious Windows logon by visualizing and analyzing Windows event log
- security
- dfir
- javascript
- visualization
- active-directory
- event-log
- +2 more
+21 stars
from 3,279 · score 3.09
5.rabbitstack / fibratus
Security sensor for realtime threat detection and protection
+17 stars
from 2,550 · score 2.89
6.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
- detection
- auditd
- +9 more
+17 stars
from 856 · score 2.89
7.last-byte / PersistenceSniper
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
- powershell-module
- powershell-script
- +3 more
+14 stars
from 2,138 · score 2.71
8.USArmyResearchLab / Dshell
Dshell is a network forensic analysis framework.
+13 stars
from 5,495 · score 2.64
9.simsong / bulk_extractor
This is the development tree. Production downloads are at:
+13 stars
from 1,429 · score 2.64
+4 stars
from 721 · score 1.61
11.gamelinux / passivedns
A network sniffer that logs all DNS server replies for use in a passive DNS setup
+1 stars
from 1,736 · score 0.69
12.dfirtrack / dfirtrack
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
- incident-management
+1 stars
from 539 · score 0.69
13.p0w3rsh3ll / AutoRuns
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
+1 stars
from 307 · score 0.69