ydkhatri / mac_apt
macOS (& ios) Artifact Parsing Tool
ydkhatri / mac_apt
wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
google / timesketch
Collaborative forensic timeline analysis
yeti-platform / yeti
Your Everyday Threat Intelligence
Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
RyanDFIR / hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
google / turbinia
Automation and Scaling of Digital Forensics Tools
Lookyloo / lookyloo
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.
RyanDFIR / unfurl
Extract and Visualize Data from URLs using Unfurl
stanfrbd / cyberbro
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
MISP / misp-warninglists
Warning lists to inform users of MISP about potential false-positives or other information in indicators
Azr43lKn1ght / DFIR-LABS
DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.
google / cloud-forensics-utils
Python library to carry out DFIR analysis on the Cloud
sambanks / octabam
A remixer for the Elektron Octatrack's OS: modules (custom DSP56300 effects, ColdFire mods, ports of community mods) composed into one firmware image built from your own 1.40C. No firmware distributed.
mxldyn / octamax
Educational reverse engineering of the Elektron Octatrack MKII firmware (OS 1.40C, ColdFire + DSP56xxx) β tooling, notes and behavior patches
huntbase-io / hunt-md
hunt.md: an open, plain-text format for threat hunts. Spec, examples and tooling.
ElekLabs / digikit
Custom patching and tooling for Elektron devices
karim852 / Kage-DFIR-toolkit
Kage ε½± is a Windows host DFIR triage console. Point it at a suspect machine, get everything back in one sealed chain: artefact collection, Sigma-correlated timeline, YARA verdicts, open sockets tied to processes, local accounts, disk root anomalies, logging blind spots, indicator reputation, and a calibrated risk score with the report behind it.
EmadAbedini / Dumplyzer
Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.
prox0959 / CyberCodex
Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Python