Ranked by Attention Score: stars gained over the last 7 complete days
19 repositories by Attention Score · Oct 28, 2026 – Nov 3, 2026 (UTC)
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
Evidence-based DSM ransomware recovery: preservation, RAM key recovery, copy decryption, and GitLab validation.
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Digging Deeper....
Volatility 3.0 development
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
Collaborative forensic timeline analysis
Security sensor for realtime threat detection and protection
Super timeline all the things
Dshell is a network forensic analysis framework.
GRR Rapid Response: remote live forensics for incident response
Network Analysis Tool
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
Rapidly Search and Hunt through Windows Forensic Artefacts
Investigate malicious Windows logon by visualizing and analyzing Windows event log
An advanced memory forensics framework