1.mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
+2,970 stars
from 12,789 · score 8.00
Trending repositories
Ranked by Attention Score: stars gained over the last 90 complete days
17 repositories by Attention Score · Aug 8, 2026 – Nov 5, 2026 (UTC)
2.volatilityfoundation / volatility3
Volatility 3.0 development
- digital-investigation
- forensics
- incident-response
- malware
- memory
- python
- +3 more
+284 stars
from 4,287 · score 5.65
3.Velocidex / velociraptor
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
- endpoint-protection
- endpoint-discovery
- +1 more
+276 stars
from 4,142 · score 5.62
4.JPCERTCC / LogonTracer
Investigate malicious Windows logon by visualizing and analyzing Windows event log
- security
- dfir
- javascript
- visualization
- active-directory
- event-log
- +2 more
+105 stars
from 3,195 · score 4.66
5.rabbitstack / fibratus
Security sensor for realtime threat detection and protection
+60 stars
from 2,507 · score 4.11
6.simsong / bulk_extractor
This is the development tree. Production downloads are at:
+48 stars
from 1,394 · score 3.89
7.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
- detection
- auditd
- +9 more
+33 stars
from 840 · score 3.53
8.USArmyResearchLab / Dshell
Dshell is a network forensic analysis framework.
+24 stars
from 5,484 · score 3.22
9.last-byte / PersistenceSniper
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
- powershell-module
- powershell-script
- +3 more
+20 stars
from 2,132 · score 3.04
+15 stars
from 710 · score 2.77
11.p0w3rsh3ll / AutoRuns
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
+8 stars
from 300 · score 2.20
12.gamelinux / passivedns
A network sniffer that logs all DNS server replies for use in a passive DNS setup
+5 stars
from 1,732 · score 1.79
13.dfirtrack / dfirtrack
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
- incident-management
+3 stars
from 537 · score 1.39
14.YelpArchive / osxcollectorArchived
A forensic evidence collection & analysis toolkit for OS X
+1 stars
from 1,888 · score 0.69
15.JPCERTCC / MalConfScan
Volatility plugin for extracts configuration data of known malware
+1 stars
from 497 · score 0.69
16.JPCERTCC / SysmonSearch
Investigate suspicious activity by visualizing Sysmon's event log
- security
- kibana
- elasticsearch
- sysmon
- stix
- stix2
+1 stars
from 431 · score 0.69
17.codeyourweb / fastfinder
Incident Response - Fast suspicious file finder
- dfir
- investigation
- incident-response
- threat-hunting
+1 stars
from 260 · score 0.69