1.sherlock-project / sherlock
Hunt down social media accounts by username across social networks
+7,658 stars
from 87,729 · score 8.94
Trending repositories
Ranked by Attention Score: stars gained over the last 90 complete days
30 repositories by Attention Score · Aug 5, 2026 – Nov 2, 2026 (UTC)
2.mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
+2,899 stars
from 12,776 · score 7.97
3.WerWolv / ImHex
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
+1,482 stars
from 54,209 · score 7.30
4.radareorg / radare2
UNIX-like reverse engineering framework and command-line toolset
+822 stars
from 24,412 · score 6.71
5.prowler-cloud / prowler
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
+669 stars
from 14,481 · score 6.51
6.volatilityfoundation / volatility3
Volatility 3.0 development
+278 stars
from 4,281 · score 5.63
7.Yamato-Security / hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
+156 stars
from 3,273 · score 5.06
8.WithSecureOpenSource / chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
+97 stars
from 3,607 · score 4.58
9.tclahr / uac
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
+83 stars
from 1,422 · score 4.43
10.Hack-with-Github / Free-Security-eBooksArchived
Free Security and Hacking eBooks
+78 stars
from 4,939 · score 4.37
11.RyanDFIR / hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
+78 stars
from 1,474 · score 4.37
12.sleuthkit / sleuthkit
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
+70 stars
from 3,113 · score 4.26
13.google / timesketch
Collaborative forensic timeline analysis
+68 stars
from 3,380 · score 4.23
14.rmusser01 / Infosec_Reference
An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.
+61 stars
from 5,969 · score 4.13
15.log2timeline / plaso
Super timeline all the things
+58 stars
from 2,127 · score 4.08
16.mozillazg / ptcpdump
Process-aware, eBPF-based tcpdump
+46 stars
from 1,249 · score 3.85
17.den4uk / andriller
📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
+39 stars
from 1,590 · score 3.69
18.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
+33 stars
from 838 · score 3.53
19.ydkhatri / mac_apt
macOS (& ios) Artifact Parsing Tool
+31 stars
from 1,067 · score 3.47
20.Mutasem-mk4 / procscope
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
+21 stars
from 24 · score 3.09
21.simsong / tcpflow
TCP/IP packet demultiplexer. Download from:
+7 stars
from 1,772 · score 2.08
22.stuhli / awesome-event-ids
Collection of Event ID ressources useful for Digital Forensics and Incident Response
+6 stars
from 661 · score 1.95
23.snovvcrash / usbripArchived
Tracking history of USB events on GNU/Linux
+4 stars
from 1,181 · score 1.61
24.dogoncouch / LogESP
Open Source SIEM (Security Information and Event Management system).
+4 stars
from 222 · score 1.61
25.TonyPhipps / Meerkat
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
+2 stars
from 481 · score 1.10
26.ShaneK2 / inVtero.net
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
+2 stars
from 295 · score 1.10
27.mgreen27 / Invoke-LiveResponse
Invoke-LiveResponse
+2 stars
from 150 · score 1.10
28.JPCERTCC / MalConfScan
Volatility plugin for extracts configuration data of known malware
+1 stars
from 497 · score 0.69
29.dogoncouch / logdissect
CLI utility and Python module for analyzing log files and other data.
+1 stars
from 161 · score 0.69
30.bad-antics / nullsec-logreaper
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
+1 stars
from 82 · score 0.69