1.interplains / zero-breach
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
+561 stars
from 549 · score 6.33
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
25 repositories by Attention Score · Oct 27, 2026 – Nov 2, 2026 (UTC)
2.sherlock-project / sherlock
Hunt down social media accounts by username across social networks
+474 stars
from 94,913 · score 6.16
3.mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
+139 stars
from 15,536 · score 4.94
4.WerWolv / ImHex
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
+126 stars
from 55,565 · score 4.84
5.radareorg / radare2
UNIX-like reverse engineering framework and command-line toolset
+81 stars
from 25,153 · score 4.41
6.prowler-cloud / prowler
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
+57 stars
from 15,093 · score 4.06
7.volatilityfoundation / volatility3
Volatility 3.0 development
+26 stars
from 4,533 · score 3.30
8.rmusser01 / Infosec_Reference
An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.
+22 stars
from 6,008 · score 3.14
9.Yamato-Security / hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
+14 stars
from 3,415 · score 2.71
10.sleuthkit / sleuthkit
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
+10 stars
from 3,173 · score 2.40
11.den4uk / andriller
📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
+8 stars
from 1,621 · score 2.20
12.Mutasem-mk4 / procscope
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
+8 stars
from 37 · score 2.20
13.WithSecureOpenSource / chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
+6 stars
from 3,698 · score 1.95
14.google / timesketch
Collaborative forensic timeline analysis
+6 stars
from 3,442 · score 1.95
15.log2timeline / plaso
Super timeline all the things
+4 stars
from 2,181 · score 1.61
16.tclahr / uac
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
+4 stars
from 1,501 · score 1.61
17.mozillazg / ptcpdump
Process-aware, eBPF-based tcpdump
+4 stars
from 1,291 · score 1.61
18.Hack-with-Github / Free-Security-eBooksArchived
Free Security and Hacking eBooks
+3 stars
from 5,014 · score 1.39
19.RyanDFIR / hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
+3 stars
from 1,549 · score 1.39
20.ydkhatri / mac_apt
macOS (& ios) Artifact Parsing Tool
+2 stars
from 1,096 · score 1.10
21.dogoncouch / LogESP
Open Source SIEM (Security Information and Event Management system).
+2 stars
from 224 · score 1.10
22.snovvcrash / usbripArchived
Tracking history of USB events on GNU/Linux
+1 stars
from 1,184 · score 0.69
23.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
+1 stars
from 870 · score 0.69
24.dogoncouch / logdissect
CLI utility and Python module for analyzing log files and other data.
+1 stars
from 161 · score 0.69
25.mgreen27 / Invoke-LiveResponse
Invoke-LiveResponse
+1 stars
from 151 · score 0.69