MemProcFS

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Rapidly Search and Hunt through Windows Forensic Artefacts

A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts

Awesome list of keywords and artifacts for Threat Hunting sessions

KQL Queries. Microsoft Defender, Microsoft Sentinel

Collection of Cyber Threat Intelligence sources from the deep and dark web

Rapid7 Labs operates as the division of Rapid7 focused on threat research. It is renowned for providing comprehensive threat intelligence, research and analytics.

This Python script checks for the CVE-2024-6387 vulnerability in OpenSSH servers. It supports multiple IP addresses, URLs, CIDR ranges, and ports. The script can also read addresses from a file.

A curated list of tools for incident response

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler…

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made w…

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

Collection of Audit and Compliance related VQL artifacts

Content and collateral for the Microsoft Sentinel SOC 101 series

The LockBit builder files

Collection of malware source code for a variety of platforms in an array of different programming languages.

A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.

practical toolkit for cybersecurity and IT professionals. It features a detailed Linux cheatsheet for incident response

Free hands-on digital forensics labs for students and faculty

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, Th…

Collection of C# projects. Useful for pentesting and redteaming.

Malware Configuration And Payload Extraction

E-Mail Header Analyzer

A little tool to play with Windows security