CAPEv2 by kevoreilly

Malware Configuration And Payload Extraction

updated at May 12, 2024, 9:27 p.m.

65 +0

1,691 +15

380 +2

caldera by mitre

Automated Adversary Emulation Platform

updated at May 12, 2024, 5:38 p.m.

168 +2

5,206 +19

1,014 +2

capa by mandiant

The FLARE team's open-source tool to identify capabilities in executable files.

updated at May 12, 2024, 4:59 p.m.

78 +0

3,881 +14

491 +0

dftimewolf by log2timeline

A framework for orchestrating forensic collection, processing and data export

updated at May 12, 2024, 4 p.m.

25 +0

276 +3

67 +0

plaso by log2timeline

Super timeline all the things

updated at May 12, 2024, 4 p.m.

92 +0

1,628 +4

324 +0

volatility3 by volatilityfoundation

Volatility 3.0 development

updated at May 12, 2024, 1:17 p.m.

55 +0

2,236 +15

371 +2

Zircolite by wagga40

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

updated at May 12, 2024, 12:13 p.m.

24 +0

601 +3

84 +0

DidierStevensSuite by DidierStevens

Please no pull requests for this repository. Thanks!

updated at May 12, 2024, 11:19 a.m.

122 +0

1,843 +3

503 +2

ThreatHunter-Playbook by OTRF

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

updated at May 12, 2024, 10:41 a.m.

370 +0

3,877 +3

796 +1

sigma by SigmaHQ

Main Sigma Rule Repository

updated at May 12, 2024, 6:07 a.m.

327 +0

7,670 +16

2,102 +9

MalConfScan by JPCERTCC

Volatility plugin for extracts configuration data of known malware

updated at May 12, 2024, 3:33 a.m.

36 +0

469 +1

68 +0

artifacts by ForensicArtifacts

Digital Forensics artifact repository

updated at May 12, 2024, 1:53 a.m.

73 -1

985 +1

202 +0

volatility by volatilityfoundation

An advanced memory forensics framework

updated at May 11, 2024, 9:42 p.m.

308 +0

6,948 +9

1,252 +2

Loki by Neo23x0

Loki - Simple IOC and YARA Scanner

updated at May 11, 2024, 3:58 p.m.

187 +0

3,251 +3

575 +1

mac_apt by ydkhatri

macOS (& ios) Artifact Parsing Tool

updated at May 11, 2024, 9:42 a.m.

44 +0

719 +1

99 +0

LogonTracer by JPCERTCC

Investigate malicious Windows logon by visualizing and analyzing Windows event log

updated at May 11, 2024, 5:23 a.m.

136 +0

2,633 +3

441 +1

grr by google

GRR Rapid Response: remote live forensics for incident response

updated at May 11, 2024, 3:25 a.m.

316 +0

4,656 +2

760 +1

RTA by endgameinc

None

updated at May 11, 2024, 1:09 a.m.

98 +0

1,035 +1

213 +0

stringsifter by mandiant

A machine learning tool that ranks strings based on their relevance for malware analysis.

updated at May 10, 2024, 1:23 p.m.

30 +0

648 +2

123 +0

timesketch by google

Collaborative forensic timeline analysis

updated at May 10, 2024, 8:32 a.m.

138 +1

2,497 +4

569 +1