caldera by mitre

Automated Adversary Emulation Platform

updated at May 19, 2024, 9:32 p.m.

166 -2

5,224 +18

1,015 +1

CAPEv2 by kevoreilly

Malware Configuration And Payload Extraction

updated at May 19, 2024, 6:41 p.m.

64 -1

1,702 +11

381 +1

acquire by fox-it

acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.

updated at May 19, 2024, 2:46 p.m.

12 +0

77 +2

18 +1

Zircolite by wagga40

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

updated at May 19, 2024, 2:13 p.m.

24 +0

604 +3

84 +0

APT-Hunter by ahmedkhlief

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

updated at May 19, 2024, 12:38 p.m.

47 +0

1,157 +4

229 +0

osxcollector by Yelp

A forensic evidence collection & analysis toolkit for OS X

updated at May 19, 2024, 6:22 a.m.

125 +0

1,860 -1

240 +0

sigma by SigmaHQ

Main Sigma Rule Repository

updated at May 19, 2024, 5:46 a.m.

327 +0

7,700 +30

2,103 +1

timesketch by google

Collaborative forensic timeline analysis

updated at May 19, 2024, 5:15 a.m.

138 +0

2,502 +5

570 +1

volatility3 by volatilityfoundation

Volatility 3.0 development

updated at May 19, 2024, 5:02 a.m.

55 +0

2,252 +16

371 +0

MalConfScan by JPCERTCC

Volatility plugin for extracts configuration data of known malware

updated at May 19, 2024, 2:36 a.m.

36 +0

471 +2

68 +0

MozDef by mozilla

DEPRECATED - MozDef: Mozilla Enterprise Defense Platform

updated at May 18, 2024, 9:36 p.m.

149 +0

2,174 +1

329 +1

volatility by volatilityfoundation

An advanced memory forensics framework

updated at May 18, 2024, 9:19 p.m.

308 +0

6,956 +8

1,249 -3

Loki by Neo23x0

Loki - Simple IOC and YARA Scanner

updated at May 18, 2024, 2:55 p.m.

187 +0

3,254 +3

575 +0

DidierStevensSuite by DidierStevens

Please no pull requests for this repository. Thanks!

updated at May 18, 2024, 1:41 p.m.

122 +0

1,847 +4

502 -1

capa by mandiant

The FLARE team's open-source tool to identify capabilities in executable files.

updated at May 18, 2024, 10:39 a.m.

79 +1

3,897 +16

494 +3

plaso by log2timeline

Super timeline all the things

updated at May 18, 2024, 10:09 a.m.

92 +0

1,629 +1

323 -1

cuckoo-modified by spender-sandbox

Modified edition of cuckoo

updated at May 18, 2024, 9:51 a.m.

72 +0

389 +1

178 +0

artifacts-kb by ForensicArtifacts

Digital Forensics Artifacts Knowledge Base

updated at May 18, 2024, 5:38 a.m.

8 +0

68 -1

15 +0

artifacts by ForensicArtifacts

Digital Forensics artifact repository

updated at May 18, 2024, 5:37 a.m.

73 +0

991 +6

204 +2

hindsight by obsidianforensics

Web browser forensics for Google Chrome/Chromium

updated at May 17, 2024, 10:51 p.m.

67 +0

1,026 +5

134 +0