interplains / zero-breach
Zero Breach โ local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
interplains / zero-breach
WerWolv / ImHex
๐ A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
rawfilejson / awesome-osint-arsenal
OSINT & recon toolkit // 100+ tools, one-command installer, SOCMINT, GEOINT, network recon, dark web, forensics & more.
CyberDefenderAI / Attack-Evidence-Compensating-Controls
A highly technical forensic and architectural guide. This module details exactly how AI-specific attacks manifest in system telemetry, followed by the rigorous, defense-in-depth security controls required to neutralize them.
sherlock-project / sherlock
Hunt down social media accounts by username across social networks
The-Art-of-Hacking / h4cker
This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. ๐ฅ Also check: https://hackertraining.org
radareorg / radare2
UNIX-like reverse engineering framework and command-line toolset
mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
prowler-cloud / prowler
Prowler is the worldโs most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
bleachbit / bleachbit
BleachBit system cleaner for Windows and Linux
cugu / awesome-forensics
โญ๏ธ A curated list of awesome forensic analysis tools and resources
google / grr
GRR Rapid Response: remote live forensics for incident response
aquasecurity / tracee
Linux Runtime Security and Forensics using eBPF
volatilityfoundation / volatility3
Volatility 3.0 development
Velocidex / velociraptor
Digging Deeper....
jekil / awesome-hacking
Awesome hacking is an awesome collection of hacking tools.
WithSecureOpenSource / chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
ljagiello / ctf-skills
Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more
google / timesketch
Collaborative forensic timeline analysis
Yamato-Security / hayabusa
Hayabusa (้ผ) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
sleuthkit / sleuthkit
The Sleuth Kitยฎ (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
seladb / PcapPlusPlus
PcapPlusPlus is a multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use. It provides C++ wrappers for the most popular packet processing engines such as libpcap, Npcap, WinPcap, DPDK, AF_XDP and PF_RING.
sepinf-inc / IPED
IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
frankwxu / digital-forensics-lab
Free hands-on digital forensics labs for students and faculty
rednaga / APKiD
Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
mesquidar / ForensicsTools
A list of free and open forensics analysis tools and other resources
AhmadHassan-BTed / NaSuno
AI audio watermark removal & forensic anti-attribution toolkit. Neutralizes Suno, Udio, and neural fingerprints with ISO 226 perceptual masking.
log2timeline / plaso
Super timeline all the things
FoxIO-LLC / ja4
JA4+ is a suite of network fingerprinting standards
TheHive-Project / Cortex
Cortex: a Powerful Observable Analysis and Active Response Engine
dfir-iris / iris-web
Collaborative Incident Response platform
RyanDFIR / hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
tclahr / uac
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
ahmedkhlief / APT-Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
domainaware / parsedmarc
A Python package and CLI for parsing aggregate and forensic DMARC reports
mozillazg / ptcpdump
Process-aware, eBPF-based tcpdump
ForensicArtifacts / artifacts
Digital Forensics artifact repository
fox-it / dissect
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
perplexityai / numbat
Visibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and forensic reconstruction.
microsoft / avml
AVML - Acquire Volatile Memory for Linux
ydkhatri / mac_apt
macOS (& ios) Artifact Parsing Tool
frangelbarrera / OSINT-BIBLE
Comprehensive 2026 OSINT guide โ 450+ tools, AI intelligence, methodologies & ethics across 35 sections for investigation & threat intel.
wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
asdfgh1445 / ctf-super-hub
้ขๅๅฐ็ฝ็จๆท็ CTF / ้ๅ Skills ๆดๅๅ ๏ผ่ชๅจๅๆตใๅคด่้ฃๆดใๆๅญฆๆจกๅผใๆฏ่ตๆจกๅผใๅชๆ็คบๆจกๅผ
google / turbinia
Automation and Scaling of Digital Forensics Tools
williballenthin / python-evtx
Pure Python parser for Windows Event Log files (.evtx)
chadi0x / TheBigBrother
The Big Brother is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.
TonyPhipps / SIEM
SIEM Tactics, Techiques, and Procedures
NateBrune / silk-guardian
<< Silk Guardian >> is an anti-forensic kill-switch that waits for a change on your usb ports and then wipes your ram, deletes precious files, and turns off your computer.
cyberdefenders / email-header-analyzer
E-Mail Header Analyzer
LETHAL-FORENSICS / Microsoft-Analyzer-Suite
A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID
DoS0x99 / cyber-security-books
A collection of FREE cyber security books
MISP / misp-warninglists
Warning lists to inform users of MISP about potential false-positives or other information in indicators
Johnng007 / Live-Forensicator
Cross-platform incident response and live forensic artifact collector with built-in detection, structured analysis, and report generation โ designed for fast, actionable security investigations.
AnonCatalyst / Ominis-OSINT
This Python application is an OSINT (Open Source Intelligence) tool called "Ominis OSINT - Web Hunter." It performs online information gathering by querying Google for search results related to a user-inputted query. The tool extracts relevant information such as titles, URLs, and potential mentions of the query in the results.
7onez / cti-expert
CTI Expert โ Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
Azr43lKn1ght / DFIR-LABS
DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.
turbot / tailpipe
select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.
digitalisx / awesome-memory-forensics
A curated list of awesome Memory Forensics for DFIR
KSwordDEV / KSword
[Windows Anti-Rootkit] KSword 5.1 is an source-available Windows toolkit for ARK, kernel debugging, and system forensics. KSword 5.1 ๆฏ้ขๅ Windows ็ๆบ็ ๅฏ่ง ARKใๅ ๆ ธ่ฐ่ฏไธ็ณป็ปๅ่ฏๅทฅๅ ท้ใ