Open-source security tools and whether they are still maintained
368 tools from 9 curated lists, checked against the GitHub API on Nov 9, 2026.
The weekly check has not run since Nov 9, 2026. Status is recalculated from the last known commit dates.
-
Agent Threat Rules (ATR)
Agent-Threat-Rule/agent-threat-rules
Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.
Detection engineeringDetection Content & SignaturesMITRelease v4.3.1, Nov 9, 2026427 stars
Active last commit today
Commits in 36 of the last 52 weeks
-
ALEAPP
Android Logs Events And Protobuf Parser
Digital forensicsMobile ForensicsMITRelease v2026.4.5, Nov 3, 20261K stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 45 of the last 52 weeks
-
Arkime
Arkime is an open source, large scale, full packet capturing, indexing, and database system.
Network monitoringNetwork MonitoringApache-2.0Release v6.9.1, Oct 22, 20267.6K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 51 of the last 52 weeks
-
cloud-forensics-utils
Python library to carry out DFIR analysis on the Cloud
Cloud securityDigital Forensics and Incident ResponseApache-2.0Release 20260917, Sep 17, 2026510 stars
Active last commit today
Commits in 16 of the last 52 weeks
-
CloudQuery
Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.
Cloud securityContinuous Security AuditingMPL-2.0Release cli-v6.50.0, Nov 2, 20266.6K stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 52 of the last 52 weeks
-
Cynative
Open-source AI agent framework for security engineering across AWS, GCP, Azure, Kubernetes, GitHub & GitLab: AI-powered security review, findings triage, detection and response.
Incident responseAll-In-One ToolsApache-2.0Release v1.14.1, Oct 22, 2026231 stars
Active last commit today
Commits in 20 of the last 52 weeks
-
Detect-It-Easy
Program for determining types of files for Windows, Linux and MacOS.
Malware analysisFile IdentificationMIT11.9K stars
- No published releases
Active last commit today
Commits in 52 of the last 52 weeks
-
dnsrecon
DNS Enumeration Script
Penetration testingActive Information GatheringGPL-2.0Release 1.6.3, Jun 28, 20263.1K stars
Active last commit today
Commits in 41 of the last 52 weeks
-
Fleetdm
Open device management
Incident responseAll-In-One ToolsLicense: otherRelease fleet-v4.94.1, Nov 6, 20267.2K stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 52 of the last 52 weeks
-
Hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Incident responseLog Analysis ToolsAGPL-3.0Release v4.3.1, Oct 28, 20263.4K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 30 of the last 52 weeks
-
iLEAPP
iOS Logs, Events, And Plist Parser
Digital forensicsMobile ForensicsMITRelease v2026.4.6, Nov 3, 20261.4K stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 50 of the last 52 weeks
-
macOS Artifact Parsing Tool (macapt)
macOS (& ios) Artifact Parsing Tool
Incident responseOSX Evidence CollectionMITRelease v.1.39.0, Nov 6, 20261.1K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 23 of the last 52 weeks
-
MFTExtractor
File system forensics
Digital forensicsNTFS/MFT ProcessingLicense: otherRelease 0.5.6, Jul 16, 202617 stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 23 of the last 52 weeks
-
Moloch
Arkime is an open source, large scale, full packet capturing, indexing, and database system.
Network monitoringFull Packet Capture / ForensicApache-2.0Release v6.9.1, Oct 22, 20267.6K stars
- Listed as aol/moloch, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 51 of the last 52 weeks
-
Netcap
A framework for secure and scalable network traffic analysis - https://netcap.io
Network monitoringNetwork MonitoringGPL-3.0Release v0.16.2, Nov 9, 20261.8K stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 23 of the last 52 weeks
-
ntopng
Web-based Traffic and Cybersecurity Network Traffic Monitoring
Network monitoringNetwork MonitoringGPL-3.0Release 7.0, Sep 22, 20268.3K stars
Active last commit today
Commits in 52 of the last 52 weeks
-
osquery
SQL powered operating system instrumentation, monitoring, and analytics.
Digital forensicsLive ForensicsLicense: otherRelease 5.24.1, Oct 29, 202623.7K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 40 of the last 52 weeks
-
passivedns
A network sniffer that logs all DNS server replies for use in a passive DNS setup
Network monitoringMonitoring / LoggingLicense: otherRelease v2.0.2, Nov 7, 20261.7K stars
Active last commit today
Commits in 4 of the last 52 weeks
-
Recog
Pattern recognition for hosts, services, and content
Network monitoringFingerprinting ToolsLicense: otherRelease v3.3.2, Oct 12, 2026799 stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 16 of the last 52 weeks
-
RSigma | Timescale
A complete Sigma detection engineering toolkit: parser, linter, formatter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:
Detection engineeringDetection Content & SignaturesMITRelease v0.26.0, Nov 2, 2026186 stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 35 of the last 52 weeks
-
Rustinel | Karib0u
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
Detection engineeringLogging, Monitoring & Data SourcesApache-2.0Release v1.11.0, Nov 8, 2026530 stars
Active last commit today
Commits in 34 of the last 52 weeks
-
Sublime Detection Rules
sublime-security/sublime-rules
Sublime rules for email attack detection, prevention, and threat hunting.
Detection engineeringDetection RulesMIT381 stars
- No published releases
Active last commit today
Commits in 51 of the last 52 weeks
-
tcpflow
TCP/IP packet demultiplexer. Download from:
Network monitoringFull Packet Capture / ForensicGPL-3.0Release v1.7.0, Nov 8, 20261.8K stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 4 of the last 52 weeks
-
UFADE
Extract files from Apple devices on Windows, Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and "advanced logical backups"
Digital forensicsAcquisitionGPL-3.0Release v1.0.5, Oct 16, 2026594 stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 23 of the last 52 weeks
-
Velociraptor
Digging Deeper....
Incident responseAll-In-One ToolsLicense: otherRelease v0.77.3, Oct 5, 20264.4K stars
Active last commit today
Commits in 50 of the last 52 weeks
-
ALEX
Extract files from ADB devices on Windows, Linux and MacOS. Mostly a wrapper for adbutils.
Digital forensicsAcquisitionGPL-3.0Release v0.7, Oct 16, 2026128 stars
- Latest release has downloads without a signature or checksum file
Active last commit yesterday
Commits in 34 of the last 52 weeks
-
ILSpy
.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
Reverse engineering.NET DecompilersMITRelease v11.2, Oct 27, 202627K stars
- Latest release has downloads without a signature or checksum file
Active last commit yesterday
Commits in 49 of the last 52 weeks
-
JADX
Dex to Java decompiler
Reverse engineeringJava DecompilersApache-2.0Release v1.5.6, Jul 10, 202651.7K stars
- Latest release has downloads without a signature or checksum file
Active last commit yesterday
Commits in 46 of the last 52 weeks
-
OSSEC
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
Detection engineeringEndpoint MonitoringGPL-2.0Release 4.4.1, Oct 18, 20265.1K stars
Active last commit yesterday
Commits in 25 of the last 52 weeks
-
pe-bear
Portable Executable reversing tool with a friendly GUI
Malware analysisInspectorGPL-2.0Release v0.7.2, Jun 5, 20263.9K stars
- Latest release has downloads without a signature or checksum file
Active last commit yesterday
Commits in 9 of the last 52 weeks
-
Sigma2KQL
Sigma Queries turned into KQL for Defender using pysigma - Automated
Detection engineeringDetection Content & SignaturesRelease 2025_11_2_Sigma2KQL, Nov 15, 20255 stars
- Fork of another repository
- No license file
Active last commit yesterday
Commits in 33 of the last 52 weeks
-
Sigma2SPL
Sigma Queries turned into SPL for Splunk Enterprise and Enterprise Security using pysigma - Automated
Network monitoringMonitoring / Logging1 stars
- No license file
- No published releases
Active last commit yesterday
Commits in 35 of the last 52 weeks
-
theHarvester
E-mails, subdomains and names Harvester - OSINT
Penetration testingPassive Information GatheringGPL-2.0Release 4.11.1, Jun 3, 202618.3K stars
Active last commit yesterday
Commits in 50 of the last 52 weeks
-
Elastic Detection Rules
Detection engineeringDetection RulesLicense: otherRelease dev-v3.0.0, Sep 25, 20263K stars
Active last commit 2 days ago
Commits in 50 of the last 52 weeks
-
MemProcFS
MemProcFS
Digital forensicsMemory ForensicsAGPL-3.0Release v5.19, Oct 5, 20264.4K stars
- Latest release has downloads without a signature or checksum file
Active last commit 2 days ago
Commits in 25 of the last 52 weeks
-
MobSF
MobSF/Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Penetration testingMobile Penetration TestingGPL-3.0Release v4.6.4, Oct 31, 202622.2K stars
Active last commit 2 days ago
Commits in 14 of the last 52 weeks
-
Nauz File Detector(NFD)
Linker/Compiler/Tool detector for Windows, Linux and MacOS.
Malware analysisDetection and ClassificationMITRelease 0.09, Oct 26, 2022585 stars
- Latest release has downloads without a signature or checksum file
Active last commit 2 days ago
Commits in 50 of the last 52 weeks
-
Plaso
Super timeline all the things
Incident responseTimeline ToolsApache-2.0Release 20261027, Oct 27, 20262.2K stars
Active last commit 2 days ago
Commits in 29 of the last 52 weeks
-
Sigma
Main Sigma Rule Repository
Incident responseLog Analysis ToolsLicense: otherRelease r2026-07-01, Jul 9, 202611.4K stars
- Latest release has downloads without a signature or checksum file
Active last commit 2 days ago
Commits in 44 of the last 52 weeks
-
turbinia
Automation and Scaling of Digital Forensics Tools
Digital forensicsFrameworksApache-2.0Release 20250131, Feb 5, 2025794 stars
Active last commit 2 days ago
Commits in 14 of the last 52 weeks
-
VAST
Tenzir is the data pipeline engine for security teams.
Network monitoringMonitoring / LoggingBSD-3-ClauseRelease v6.21.0, Nov 4, 2026770 stars
- Listed as tenzir/vast, since renamed or moved
- Latest release has a checksum file but no signature
Active last commit 2 days ago
Commits in 51 of the last 52 weeks
-
WAZUH
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Detection engineeringEndpoint MonitoringLicense: otherRelease v4.14.10, Nov 9, 202617.6K stars
Active last commit 2 days ago
Commits in 51 of the last 52 weeks
-
zipdump
Analyze zipfile, either local, or from url
Malware analysisIOC and Pattern IdentificationMIT39 stars
- No published releases
Active last commit 2 days ago
Commits in 2 of the last 52 weeks
-
AVML
AVML - Acquire Volatile Memory for Linux
Incident responseMemory Analysis ToolsMITRelease v0.21.0, Oct 9, 20261.1K stars
- Latest release has downloads without a signature or checksum file
Active last commit 3 days ago
Commits in 26 of the last 52 weeks
-
capa
The FLARE team's open-source tool to identify capabilities in executable files.
Malware analysisDetection and ClassificationApache-2.0Release v10.0.0, Oct 16, 20266.3K stars
- Listed as fireeye/capa, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 3 days ago
Commits in 45 of the last 52 weeks
-
Chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
Incident responseLog Analysis ToolsGPL-3.0Release v2.17.1, Oct 14, 20263.7K stars
- Listed as countercept/chainsaw, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 3 days ago
Commits in 17 of the last 52 weeks
-
DFTimewolf
A framework for orchestrating forensic collection, processing and data export
Incident responseIncident ManagementApache-2.0361 stars
- No published releases
Active last commit 3 days ago
Commits in 35 of the last 52 weeks
-
Falco
Cloud Native Runtime Security
Cloud securityContinuous Security AuditingApache-2.0Release 0.45.2, Oct 29, 20269.6K stars
- Latest release has downloads without a signature or checksum file
Active last commit 3 days ago
Commits in 49 of the last 52 weeks
-
KapeFiles
This repository serves as a place for community created Targets and Modules for use with KAPE.
Malware analysisFile IdentificationMIT894 stars
- No published releases
Active last commit 3 days ago
Commits in 22 of the last 52 weeks
-
Quark-Engine
Malware analysisDetection and ClassificationGPL-3.0Release v26.11.1, Nov 7, 20261.7K stars
- Listed as quark-engine/quark-engine, since renamed or moved
Active last commit 3 days ago
Commits in 49 of the last 52 weeks
-
Sublime
sublime-security/sublime-platform
A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, collaborate with the community, and write detections-as-code.
Detection engineeringDetection, Alerting and Automation PlatformsMIT277 stars
- No published releases
Active last commit 3 days ago
Commits in 25 of the last 52 weeks
-
Zeek
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
Network monitoringNetwork MonitoringLicense: otherRelease v9.0.1, Oct 26, 20268.2K stars
Active last commit 3 days ago
Commits in 50 of the last 52 weeks
-
Fibratus
Security sensor for realtime threat detection and protection
Incident responseWindows Evidence CollectionLicense: otherRelease v3.1.1, Aug 19, 20262.6K stars
- Latest release has a checksum file but no signature
Active last commit 4 days ago
Commits in 40 of the last 52 weeks
-
panther-labs
Built-in Panther detection rules and policies
Cloud securityDigital Forensics and Incident ResponseApache-2.0Release v3.114.0, Aug 27, 2026473 stars
Active last commit 4 days ago
Commits in 40 of the last 52 weeks
-
MISP Workbench
Built for the frontlines of cyber defense, our next-generation MISP empowers edge deployments and threat hunters with fast, lightweight, and actionable intelligence, anytime, anywhere.
Threat intelligenceToolsAGPL-3.0Release beta-1.6, Jul 9, 202636 stars
Active last commit 5 days ago
Commits in 41 of the last 52 weeks
-
SOCTalk
AI-powered multi-tenant SOC automation agent using LangGraph with Wazuh, Cortex, TheHive & MISP integration
Detection engineeringLogging, Monitoring & Data SourcesApache-2.0Release v0.2.2, Nov 2, 202690 stars
- Latest release has downloads without a signature or checksum file
Active last commit 5 days ago
Commits in 20 of the last 52 weeks
-
Splunk Security Content
Splunk Security Content
Detection engineeringDetection Content & SignaturesApache-2.0Release v6.10.0, Nov 4, 20261.7K stars
- Latest release has downloads without a signature or checksum file
Active last commit 5 days ago
Commits in 49 of the last 52 weeks
-
Substation
Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
Detection engineeringDetection, Alerting and Automation PlatformsMITRelease v2.9.2, Nov 3, 2026409 stars
Active last commit 5 days ago
Commits in 5 of the last 52 weeks
-
Sysmon for Linux
Sysmon for Linux
Detection engineeringEndpoint MonitoringMITRelease 1.6.0, Nov 6, 20262.2K stars
- Listed as Sysinternals/SysmonForLinux, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 5 days ago
Commits in 12 of the last 52 weeks
-
FernFlower
Decompiler from Java bytecode to Java, used in IntelliJ IDEA.
Reverse engineeringJava DecompilersApache-2.04.4K stars
- Listed as fesh0r/fernflower, since renamed or moved
- No published releases
Active last commit 6 days ago
Commits in 25 of the last 52 weeks
-
Sandia Cyber Omni Tracker (SCOT)
Sandia Cyber Omni Tracker (SCOT)
Incident responseIncident ManagementLicense: otherRelease v3.20.0, Aug 15, 2022254 stars
- Latest release has downloads without a signature or checksum file
Active last commit 6 days ago
Commits in 1 of the last 52 weeks
-
Timesketch
Collaborative forensic timeline analysis
Incident responseTimeline ToolsApache-2.0Release 20261014, Oct 14, 20263.4K stars
Active last commit 6 days ago
Commits in 41 of the last 52 weeks
-
Zentral
Zentral is a control plane for secure, observable Apple endpoints in enterprises. Configure, observe, and enforce the desired state of every Apple endpoint. Manage that desired state as code through GitOps and Terraform.
Incident responseAll-In-One ToolsLicense: otherRelease v2026.5, Aug 21, 2026890 stars
Active last commit 6 days ago
Commits in 49 of the last 52 weeks
-
Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
Incident responseLog Analysis ToolsLicense: otherRelease v4.7.1, Nov 2, 2026875 stars
- Latest release has a checksum file but no signature
Active last commit 6 days ago
Commits in 27 of the last 52 weeks
-
Ridgeline Detection Library
ridgelinecyberdefence/Enterprise-Detection-Engineering
Production-validated detection queries and hunting artifacts across 9 platforms (KQL, Sigma, Splunk, Athena, PowerShell, Velociraptor, YARA, Suricata, osquery). Each with triggers, false positives, tuning guidance, and validation steps.
Detection engineeringDetection Content & SignaturesApache-2.011 stars
- No published releases
Active last commit 7 days ago
Commits in 4 of the last 52 weeks
-
TerraSigma
TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel
Detection engineeringDetection Content & SignaturesRelease 2025_11_2_TerraSigma, Nov 17, 20255 stars
- No license file
Active last commit 7 days ago
Commits in 30 of the last 52 weeks
-
WELA
WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.
Incident responseLog Analysis ToolsMITRelease v2.1.0, Feb 13, 2026129 stars
Active last commit 7 days ago
Commits in 36 of the last 52 weeks
-
Dissect
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
Incident responseAll-In-One ToolsAGPL-3.0Release 3.22, Feb 26, 20261.2K stars
Active last commit 8 days ago
Commits in 6 of the last 52 weeks
-
Forensic Artifacts
Digital Forensics artifact repository
Incident responseEvidence CollectionApache-2.0Release 20260127, Jan 27, 20261.3K stars
Active last commit 8 days ago
Commits in 18 of the last 52 weeks
-
IOC Fanger (and Defanger)
Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .
Threat intelligenceToolsMIT67 stars
- Listed as ioc-fang/ioc_fanger, since renamed or moved
- No published releases
Active last commit 8 days ago
Commits in 24 of the last 52 weeks
-
CrowdSec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Network monitoringIDS / IPS / Host IDS / Host IPSMITRelease v1.8.2, Oct 26, 202615.5K stars
- Latest release has downloads without a signature or checksum file
Active last commit 9 days ago
Commits in 43 of the last 52 weeks
-
hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
Digital forensicsInternet ArtifactsApache-2.0Release v2026.06, Jul 8, 20261.6K stars
- Latest release has downloads without a signature or checksum file
Active last commit 9 days ago
Commits in 35 of the last 52 weeks
-
Krakatau
Java decompiler, assembler, and disassembler
Reverse engineeringJava DecompilersApache-2.02.3K stars
- No published releases
Active last commit 10 days ago
Commits in 5 of the last 52 weeks
-
MSTIC Jupyter and Python Security Tools
Microsoft Threat Intelligence Security Tools
Threat intelligenceToolsLicense: otherRelease v3.1.0, Sep 21, 20262K stars
Active last commit 10 days ago
Commits in 26 of the last 52 weeks
-
Dshell
Dshell is a network forensic analysis framework.
Network monitoringFull Packet Capture / ForensicLicense: otherRelease v3.2.3, May 7, 20245.5K stars
Active last commit 11 days ago
Commits in 1 of the last 52 weeks
-
Orochi
The Volatility Collaborative GUI
Incident responseMemory Analysis ToolsMITRelease v.2.7.0, Oct 29, 2026280 stars
Active last commit 11 days ago
Commits in 4 of the last 52 weeks
-
TypeDB CTI
Open Source Threat Intelligence Platform
Threat intelligenceFrameworks and Platforms168 stars
- No license file
- No published releases
Active last commit 11 days ago
Commits in 2 of the last 52 weeks
-
unfurl
Extract and Visualize Data from URLs using Unfurl
Digital forensicsInternet ArtifactsApache-2.0Release v2026.11, Oct 29, 2026782 stars
Active last commit 11 days ago
Commits in 16 of the last 52 weeks
-
APKTool
A tool for reverse engineering Android apk files
Penetration testingMobile Penetration TestingApache-2.0Release v3.0.3, Jul 20, 202627.1K stars
- Latest release has downloads without a signature or checksum file
Active last commit 12 days ago
Commits in 37 of the last 52 weeks
-
Darkmoon
Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.
Penetration testingPenetration TestingGPL-3.0Release v1.6.0, Oct 25, 20261.2K stars
Active last commit 12 days ago
Commits in 41 of the last 52 weeks
-
Magisk
The Magic Mask for Android
Penetration testingMobile Penetration TestingGPL-3.0Release v31.1, Oct 25, 202663.9K stars
- Latest release has downloads without a signature or checksum file
Active last commit 12 days ago
Commits in 43 of the last 52 weeks
-
The Sleuth Kit
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
Digital forensicsFrameworksRelease sleuthkit-4.15.0, Apr 15, 20263.2K stars
- No license file
Active last commit 12 days ago
Commits in 34 of the last 52 weeks
-
yara
The pattern matching swiss knife
Malware analysisIOC and Pattern IdentificationBSD-3-ClauseRelease v4.6.0, Oct 27, 202610K stars
- Latest release has downloads without a signature or checksum file
Active last commit 13 days ago
Commits in 16 of the last 52 weeks
-
IOC Finder
Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/
Threat intelligenceToolsLGPL-3.0182 stars
- No published releases
Active last commit 14 days ago
Commits in 33 of the last 52 weeks
-
AndroGuard
Reverse engineering and pentesting for Android applications
Penetration testingMobile Penetration TestingApache-2.0Release v4.1.4, Jun 5, 20266.4K stars
- Latest release has downloads without a signature or checksum file
Active last commit 15 days ago
Commits in 7 of the last 52 weeks
-
IPED - Indexador e Processador de Evidências Digitais
IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Digital forensicsFrameworksLicense: otherRelease 4.3.1, Mar 29, 20263.1K stars
- Latest release has downloads without a signature or checksum file
Active last commit 16 days ago
Commits in 45 of the last 52 weeks
-
flare-floss
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Malware analysisStringsApache-2.0Release v3.2.0, Oct 16, 20264.2K stars
- Latest release has downloads without a signature or checksum file
Active last commit 18 days ago
Commits in 38 of the last 52 weeks
-
FLOSS
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Malware analysisDeobfuscationApache-2.0Release v3.2.0, Oct 16, 20264.2K stars
- Listed as fireeye/flare-floss, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 18 days ago
Commits in 38 of the last 52 weeks
-
Cortex
Cortex: a Powerful Observable Analysis and Active Response Engine
Threat intelligenceFrameworks and PlatformsAGPL-3.0Release 4.2.0, Oct 20, 20261.6K stars
Active last commit 19 days ago
Commits in 9 of the last 52 weeks
-
fn2yara
Automated static analysis tools for binary programs
Malware analysisDetection and ClassificationLicense: other1.7K stars
- No published releases
Active last commit 19 days ago
Commits in 14 of the last 52 weeks
-
PortEx
Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
Malware analysisDetection and ClassificationApache-2.0Release v6.0.0, Oct 21, 2026544 stars
- Listed as katjahahn/PortEx, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 19 days ago
Commits in 5 of the last 52 weeks
-
Exabeam Common Information Model
CIM Library
Detection engineeringLogging, Monitoring & Data SourcesApache-2.012 stars
- No published releases
Active last commit 20 days ago
Commits in 9 of the last 52 weeks
-
Chronicle (GCP) Detection Rules
Collection of example YARA-L rules for use within Google Security Operations
Detection engineeringDetection Content & SignaturesApache-2.0Release content-manager-v1.0.7, Nov 12, 2025524 stars
Active last commit 23 days ago
Commits in 5 of the last 52 weeks
-
sysmon-modular
A repository of sysmon configuration modules
Detection engineeringConfigurationMITRelease configs-a45dedb13a43, Oct 14, 20263.2K stars
- Latest release has a checksum file but no signature
Active last commit 26 days ago
Commits in 10 of the last 52 weeks
-
KQL Advanced Hunting Queries & Analytics Rules
Bert-JanP/Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Detection engineeringDetection Content & SignaturesBSD-3-Clause1.8K stars
- No published releases
Active last commit 27 days ago
Commits in 23 of the last 52 weeks
-
Bulk Extractor
This is the development tree. Production downloads are at:
Digital forensicsDigital ForensicsLicense: otherRelease v2.2.0, Aug 18, 20261.4K stars
- Latest release has a checksum file but no signature
Active last commit 28 days ago
Commits in 9 of the last 52 weeks
-
Volatility 3
volatilityfoundation/volatility3
Volatility 3.0 development
Incident responseMemory Analysis ToolsLicense: otherRelease v2.28.2, Sep 17, 20264.6K stars
- Latest release has downloads without a signature or checksum file
Active last commit 28 days ago
Commits in 29 of the last 52 weeks
-
Amele
Unified digital forensics platform bringing disk, RAM, container drift, logical acquisition, and backup analysis together for Windows, Linux, Docker, Android, and iOS.
Digital forensicsAcquisitionLicense: otherRelease v0.1.1, Oct 8, 202629 stars
- Moved from noirlang to melihemik after it was listed
- Latest release has downloads without a signature or checksum file
Active last commit 30 days ago
Commits in 22 of the last 52 weeks
-
Flare
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Incident responseAll-In-One ToolsApache-2.0Release vbox-1.0.0, Aug 13, 20259.3K stars
- Listed as fireeye/flare-vm, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 32 days ago
Commits in 7 of the last 52 weeks
-
Recon-ng
Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.
Penetration testingPenetration TestingGPL-3.06K stars
- No published releases
Active last commit 35 days ago
Commits in 1 of the last 52 weeks
-
uncompyle6
A cross-version Python bytecode decompiler
Malware analysisDeobfuscationGPL-3.0Release 3.9.3, Sep 29, 20254.3K stars
- Latest release has downloads without a signature or checksum file
Active last commit 35 days ago
Commits in 8 of the last 52 weeks
-
GRR Rapid Response
GRR Rapid Response: remote live forensics for incident response
Incident responseAll-In-One ToolsApache-2.0Release v.4.0.0.0-release, Dec 15, 20255.1K stars
Active last commit 38 days ago
Commits in 7 of the last 52 weeks
-
Shuffle
Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
Incident responseIncident ManagementAGPL-3.0Release v2.3.0, Sep 28, 20262.5K stars
- Listed as frikky/Shuffle, since renamed or moved
Active last commit 41 days ago
Commits in 42 of the last 52 weeks
-
Shuffle
Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
Detection engineeringDetection, Alerting and Automation PlatformsAGPL-3.0Release v2.3.0, Sep 28, 20262.5K stars
Active last commit 41 days ago
Commits in 42 of the last 52 weeks
-
IRIS
Collaborative Incident Response platform
Incident responseAll-In-One ToolsLGPL-3.0Release v2.4.29, Aug 10, 20261.6K stars
Active last commit 46 days ago
Commits in 28 of the last 52 weeks
-
Mercury
Mercury: network metadata capture and analysis
Network monitoringFingerprinting ToolsLicense: other522 stars
- No published releases
Active last commit 46 days ago
Commits in 44 of the last 52 weeks
-
APT Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
Incident responseLog Analysis ToolsGPL-3.0Release V4.0, Sep 20, 20261.4K stars
- Latest release has downloads without a signature or checksum file
Active last commit 50 days ago
Commits in 1 of the last 52 weeks
-
Fast Incident Response (FIR)
Fast Incident Response
Incident responseIncident ManagementGPL-3.0Release django4, Sep 13, 20222K stars
Active last commit 56 days ago
Commits in 22 of the last 52 weeks
-
go-audit
go-audit is an alternative to the auditd daemon that ships with many distros
Detection engineeringEndpoint MonitoringMITRelease v1.2.2, Jun 22, 20261.7K stars
Active last commit 61 days ago
Commits in 10 of the last 52 weeks
-
UAC
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
Incident responseEvidence CollectionApache-2.0Release v3.4.0, Sep 9, 20261.5K stars
- Latest release has a checksum file but no signature
Active last commit 61 days ago
Commits in 25 of the last 52 weeks
-
IntelOwl
IntelOwl: manage your Threat Intelligence at scale
Threat intelligenceFrameworks and PlatformsAGPL-3.0Release v6.8.0, Aug 31, 20264.8K stars
Active last commit 68 days ago
Commits in 35 of the last 52 weeks
-
Manalyze
A static analyzer for PE executables.
Malware analysisDetection and ClassificationGPL-3.0Release v1.0.0, Jul 21, 20261.2K stars
- Latest release has downloads without a signature or checksum file
Active last commit 72 days ago
Commits in 7 of the last 52 weeks
-
Blauhaunt
A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts
Digital forensicsWindows ArtifactsMIT188 stars
- No published releases
Active last commit 82 days ago
Commits in 6 of the last 52 weeks
-
GQUIC Protocol Analyzer for Zeek
salesforce/GQUIC_Protocol_Analyzer
GQUIC Protocol Analyzer for Zeek (Bro) Network Security Monitor
Network monitoringFingerprinting ToolsLicense: other83 stars
- No published releases
Active last commit 87 days ago
Commits in 2 of the last 52 weeks
-
Active last commit 87 days ago
Commits in 2 of the last 52 weeks
-
Acquire
acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.
Incident responseEvidence CollectionAGPL-3.0Release 3.22, Feb 26, 2026121 stars
Active last commit 89 days ago
Commits in 12 of the last 52 weeks
-
LogonTracer
Investigate malicious Windows logon by visualizing and analyzing Windows event log
Incident responseLog Analysis ToolsLicense: otherRelease v2.0.0, Apr 22, 20263.3K stars
Slowing last commit 99 days ago
Commits in 2 of the last 52 weeks
-
VanGuard
ridgelinecyberdefence/vanguard
Cross-platform incident response toolkit. 28 pre-built use cases in a single zero-install binary: triage, threat hunting, memory forensics, disk collection, remote operations, and Velociraptor management. Works air-gapped, with automated timeline generation.
Incident responseAll-In-One ToolsMITRelease v1.0.1, Jul 6, 2026162 stars
- Latest release has a checksum file but no signature
Slowing last commit 103 days ago
Commits in 3 of the last 52 weeks
-
opensnitch
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
Network monitoringMonitoring / LoggingGPL-3.0Release v1.8.0, Dec 15, 202514.3K stars
Slowing last commit 105 days ago
Commits in 27 of the last 52 weeks
-
RecuperaBit
A tool for forensic file system reconstruction.
Digital forensicsNTFS/MFT ProcessingGPL-3.0Release v1.1.6, Jan 2, 2022624 stars
Slowing last commit 105 days ago
Commits in 3 of the last 52 weeks
-
Catalyst
⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes
Incident responseIncident ManagementAGPL-3.0Release v0.15.7, Jan 11, 2026537 stars
- Latest release has a checksum file but no signature
Archived archived by the owner, last commit 114 days ago
Commits in 11 of the last 52 weeks
-
PyInstaller Extractor
extremecoders-re/pyinstxtractor
PyInstaller Extractor
Malware analysisDeobfuscationGPL-3.0Release 2026.07, Jul 22, 20264.5K stars
Slowing last commit 129 days ago
Commits in 2 of the last 52 weeks
-
Detection Engineering with Splunk
west-wind/Threat-Hunting-With-Splunk
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
Detection engineeringDetection Content & SignaturesMIT69 stars
- No published releases
Slowing last commit 130 days ago
Commits in 3 of the last 52 weeks
-
NTFSTool
Forensics tool for NTFS (parser, mft, bitlocker, deleted files)
Digital forensicsNTFS/MFT ProcessingMITRelease v1.7, Jul 23, 2023637 stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 135 days ago
Commits in 2 of the last 52 weeks
-
unixcollector
unix_collector is a Live Response collection script for Incident Response on UNIX-like systems using native binaries. Supports AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
Digital forensicsAcquisitionGPL-3.0Release 2.0, Jun 10, 202545 stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 143 days ago
Commits in 1 of the last 52 weeks
-
AIFT
AIFT is a GUI, CLI, REST API, and MCP tool that helps DFIR analysts get oriented quickly. Point it at disk images, VM images, forensic archives, or triage packages; AIFT discovers what can be opened, parses artifacts with Dissect, and uses AI to turn parsed data into concrete leads and gaps for the investigator to verify.
Digital forensicsFrameworksAGPL-3.0Release v2.0, Jun 13, 202653 stars
Slowing last commit 148 days ago
Commits in 12 of the last 52 weeks
-
Machinae
Machinae Security Intelligence Collector
Threat intelligenceToolsMITRelease 1.4.8, May 9, 2019536 stars
Slowing last commit 158 days ago
Commits in 1 of the last 52 weeks
-
n6
Automated handling of data feeds for security teams
Threat intelligenceFrameworks and PlatformsAGPL-3.0Release v4.42.0, Jun 3, 2026148 stars
Slowing last commit 158 days ago
Commits in 3 of the last 52 weeks
-
Fuji
macOS forensic acquisition made simple
Digital forensicsAcquisitionGPL-3.0Release 1.2.0, Feb 14, 2026321 stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 160 days ago
Commits in 7 of the last 52 weeks
-
Fakenet-NG
FakeNet-NG - Next Generation Dynamic Network Analysis Tool
Malware analysisDynamic Analysis ToolsApache-2.0Release v3.5, Apr 9, 20252.2K stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 164 days ago
Commits in 3 of the last 52 weeks
-
RegRipper
RegRipper3.0
Incident responseWindows Evidence CollectionLicense: other726 stars
- No published releases
Slowing last commit 166 days ago
Commits in 3 of the last 52 weeks
-
ThreatIngestor
Extract and aggregate threat intelligence.
Threat intelligenceToolsGPL-2.0Release v1.4.0, Nov 2, 2023931 stars
- Listed as InQuest/ThreatIngestor, since renamed or moved
Slowing last commit 166 days ago
Commits in 1 of the last 52 weeks
-
RegRippy
A modern Python-3-based alternative to RegRipper
Digital forensicsWindows ArtifactsApache-2.0219 stars
- No published releases
Slowing last commit 180 days ago
Commits in 1 of the last 52 weeks
-
threatintel
Threat Intelligence APIs
Threat intelligenceToolsMITRelease v0.2.0, Apr 23, 2020284 stars
Slowing last commit 187 days ago
Commits in 2 of the last 52 weeks
-
auditd configuration
Best Practice Auditd Configuration
Detection engineeringConfigurationApache-2.0Release v0.2.0, Apr 21, 20262K stars
Slowing last commit 189 days ago
Commits in 5 of the last 52 weeks
-
IntelMQ
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
Digital forensicsFrameworksAGPL-3.0Release 3.5.0, Nov 1, 20251.1K stars
Slowing last commit 198 days ago
Commits in 7 of the last 52 weeks
-
wafw00f
WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.
Penetration testingActive Information GatheringBSD-3-ClauseRelease v2.4.2, Jan 26, 20266.6K stars
Slowing last commit 204 days ago
Commits in 6 of the last 52 weeks
-
autosecure
Threat-feed IP block automation for Linux and macOS firewalls (iptables, nftables, pf) with cron-ready updates, dry-run previews, and package releases.
Malware analysisThreat IntelligenceGPL-3.0Release v2.3.4, Apr 16, 202617 stars
Slowing last commit 206 days ago
Commits in 4 of the last 52 weeks
-
NullSec LogReaper
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
Incident responseLog Analysis ToolsMITRelease v1.1.0, Mar 21, 202683 stars
Slowing last commit 207 days ago
Commits in 4 of the last 52 weeks
-
Sysdig
Linux system exploration and troubleshooting tool with first class support for containers
Detection engineeringEndpoint MonitoringLicense: otherRelease 0.41.4, Jan 29, 20268.3K stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 210 days ago
Commits in 6 of the last 52 weeks
-
Hypoxia
Zero-dependency Python CLI for targeted file collection - digital forensics, incident response, and selective backups. Cross-platform, with SHA-256 manifests, chain-of-custody logging, and checkpoint/resume for failing media.
Digital forensicsAcquisitionGPL-3.0Release 1.3.0, Apr 9, 20264 stars
- Latest release has a checksum file but no signature
Slowing last commit 213 days ago
Commits in 4 of the last 52 weeks
-
Drozer
The Leading Security Assessment Framework for Android.
Penetration testingMobile Penetration TestingLicense: otherRelease 3.1.0, Aug 1, 20244.6K stars
- Listed as mwrlabs/drozer, since renamed or moved
- Latest release has downloads without a signature or checksum file
Slowing last commit 215 days ago
Commits in 3 of the last 52 weeks
-
LiME
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory capt
Incident responseMemory Analysis ToolsGPL-2.0Release v1.12.0, Mar 31, 20262.1K stars
- Listed as 504ensicsLabs/LiME, since renamed or moved
Slowing last commit 218 days ago
Commits in 4 of the last 52 weeks
-
LiME
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory capt
Digital forensicsAcquisitionGPL-2.0Release v1.12.0, Mar 31, 20262.1K stars
Slowing last commit 218 days ago
Commits in 4 of the last 52 weeks
-
WhatWeb
Next generation web scanner
Penetration testingPassive Information GatheringGPL-2.0Release v0.6.4, Apr 2, 20267K stars
Slowing last commit 220 days ago
Commits in 1 of the last 52 weeks
-
Anvilogic Detection Armory
Anvilogic Forge
Detection engineeringDetection Content & SignaturesGPL-3.0119 stars
- No published releases
Slowing last commit 223 days ago
Commits in 1 of the last 52 weeks
-
POFR
Penguin OS Forensic (or Flight) Recorder
Digital forensicsLive ForensicsGPL-2.0Release v1.4.0, Mar 27, 202641 stars
Slowing last commit 226 days ago
Commits in 2 of the last 52 weeks
-
ole-tools
oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
Malware analysisMicrosoft OfficeLicense: otherRelease v0.60.2, Jul 2, 20243.4K stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 286 days ago
Commits in 1 of the last 52 weeks
-
AWS Security Automation
awslabs/aws-security-automation
Collection of scripts and resources for DevSecOps and Automated Incident Response Security
Cloud securityDigital Forensics and Incident Response632 stars
- No license file
- No published releases
Archived archived by the owner, last commit 298 days ago
Commits in 1 of the last 52 weeks
-
DFIRTrack
DFIRTrack - The Incident Response Tracking Application
Incident responseIncident ManagementLicense: other539 stars
- No published releases
Slowing last commit 299 days ago
Commits in 2 of the last 52 weeks
-
RITA
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
Threat intelligenceToolsGPL-3.0Release v4.8.2, Jan 12, 20262.5K stars
- Listed as ocmdev/rita, since renamed or moved
- Latest release has downloads without a signature or checksum file
Slowing last commit 300 days ago
Commits in 2 of the last 52 weeks
-
Yara rules generator
yarGen is a generator for YARA rules
Malware analysisDetection and ClassificationLicense: otherRelease 0.23.4, Dec 29, 20201.8K stars
Slowing last commit 302 days ago
Commits in 1 of the last 52 weeks
-
Loki
Loki - Simple IOC and YARA Scanner
Malware analysisIOC and Pattern IdentificationGPL-3.0Release v0.51.0, May 18, 20233.8K stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 303 days ago
Commits in 1 of the last 52 weeks
-
OpenTAXII
TAXII server implementation in Python from EclecticIQ
Threat intelligenceFrameworks and PlatformsBSD-3-ClauseRelease 0.10.0b1, Jan 5, 2026216 stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 307 days ago
Commits in 4 of the last 52 weeks
-
ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
Detection engineeringDetection RulesMIT4.7K stars
- No published releases
Slowing last commit 314 days ago
Commits in 0 of the last 52 weeks
-
FIT
FIT is a modular suite of Python applications for digital forensic acquisition of online contents such as web pages, emails, social media, and more. Each module can run independently or as part of the full FIT suite.
Digital forensicsAcquisitionGPL-3.0Release v2.2.0, Mar 16, 2025108 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 378 days ago
Commits in 0 of the last 52 weeks
-
ElectricEye
ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations to harden your CSP & SaaS environments with controls mapped to over 20 industry, regulatory, and best practice controls frameworks
Cloud securityContinuous Security AuditingApache-2.01K stars
- No published releases
Inactive last commit 432 days ago
Commits in 0 of the last 52 weeks
-
BoxyHQ
🔥 A fully open source audit logs service and embeddable UI easily deployed to your own Kubernetes cluster. Brought to you by replicated.com and boxyhq.com 🚀
Network monitoringMonitoring / LoggingApache-2.0Release v1.13.1, Nov 6, 2024451 stars
Inactive last commit 439 days ago
Commits in 0 of the last 52 weeks
-
un{i}packer
Automatic and platform-independent unpacker for Windows binaries based on emulation
Malware analysisDeobfuscationGPL-2.0Release 1.0.8, May 21, 2024782 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 447 days ago
Commits in 0 of the last 52 weeks
-
Stixview
STIX2 graph visualisation library in JS
Threat intelligenceToolsBSD-3-ClauseRelease v2.2.0, Jul 14, 2024100 stars
Inactive last commit 505 days ago
Commits in 0 of the last 52 weeks
-
Loghub
A large collection of system log datasets for AI-driven log analytics [ISSRE'23]
Detection engineeringLogging, Monitoring & Data SourcesLicense: other2.9K stars
- No published releases
Inactive last commit 513 days ago
Commits in 0 of the last 52 weeks
-
xortool
A tool to analyze multi-byte xor cipher
Malware analysisDeobfuscation1.5K stars
- No license file
- No published releases
Inactive last commit 537 days ago
Commits in 0 of the last 52 weeks
-
Volatility
volatilityfoundation/volatility
An advanced memory forensics framework
Incident responseMemory Analysis ToolsGPL-2.0Release 2.6.1, Apr 9, 20248.1K stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 542 days ago
Commits in 0 of the last 52 weeks
-
SOC Multi-tool
A powerful and user-friendly browser extension that streamlines investigations for security professionals.
Incident responseAll-In-One ToolsMIT424 stars
- No published releases
Inactive last commit 544 days ago
Commits in 0 of the last 52 weeks
-
artifactcollector
forensicanalysis/artifactcollector
🧭 The artifactcollector is a customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
Incident responseEvidence CollectionMITRelease v0.17.1, Oct 19, 2024306 stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 550 days ago
Commits in 0 of the last 52 weeks
-
HASSH
HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of a small MD5 fingerprint.
Network monitoringFingerprinting ToolsBSD-3-Clause553 stars
- No published releases
Archived archived by the owner, last commit 556 days ago
Commits in 0 of the last 52 weeks
-
JA3
JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.
Network monitoringFingerprinting ToolsBSD-3-Clause3.1K stars
- No published releases
Archived archived by the owner, last commit 556 days ago
Commits in 0 of the last 52 weeks
-
ForensicMiner
A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
Digital forensicsAcquisitionMITRelease v1.4, Dec 30, 2023166 stars
Inactive last commit 582 days ago
Commits in 0 of the last 52 weeks
-
Matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
Incident responseAll-In-One ToolsApache-2.01.7K stars
- No published releases
Inactive last commit 670 days ago
Commits in 0 of the last 52 weeks
-
AIOCRIOC
An LLM and OCR based Indicator of Compromise Extraction Tool
Threat intelligenceToolsApache-2.038 stars
- No published releases
Inactive last commit 704 days ago
Commits in 0 of the last 52 weeks
-
MEERKAT
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
Incident responseWindows Evidence CollectionGPL-3.0483 stars
- No published releases
Inactive last commit 723 days ago
Commits in 0 of the last 52 weeks
-
SPECTR3
Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.
Incident responseEvidence CollectionLGPL-3.0Release v0.7.7, Oct 25, 202444 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 745 days ago
Commits in 0 of the last 52 weeks
-
Kuiper
Digital Forensics Investigation Platform
Incident responseAll-In-One ToolsRelease v2.3.5, Nov 18, 2023915 stars
- No license file
Inactive last commit 758 days ago
Commits in 0 of the last 52 weeks
-
iocextract
Defanged Indicator of Compromise (IOC) Extractor.
Threat intelligenceToolsGPL-2.0Release v1.16.1, Sep 22, 2023581 stars
- Listed as InQuest/python-iocextract, since renamed or moved
Inactive last commit 802 days ago
Commits in 0 of the last 52 weeks
-
Logdissect
CLI utility and Python module for analyzing log files and other data.
Incident responseLog Analysis ToolsMITRelease v3.1.1, Apr 7, 2018162 stars
Inactive last commit 823 days ago
Commits in 0 of the last 52 weeks
-
timeliner
A rewrite of mactime, a bodyfile reader
Digital forensicsTimeline AnalysisApache-2.040 stars
- No published releases
Inactive last commit 826 days ago
Commits in 0 of the last 52 weeks
-
Wombat Forensics
linux c++, fox-toolkit, multi-threaded forensic gui tool
Digital forensicsFrameworksGPL-2.047 stars
- No published releases
Inactive last commit 842 days ago
Commits in 0 of the last 52 weeks
-
Google Cloud Security Analytics
GoogleCloudPlatform/security-analytics
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
Detection engineeringDetection Content & SignaturesApache-2.0371 stars
- No published releases
Archived archived by the owner, last commit 879 days ago
Commits in 0 of the last 52 weeks
-
ViperMonkey
A VBA parser and emulation engine to analyze malicious macros.
Malware analysisMicrosoft Office1.1K stars
- No license file
- No published releases
Inactive last commit 927 days ago
Commits in 0 of the last 52 weeks
-
DataCop
Protect your data in AWS S3 with DataCop!
Cloud securityDigital Forensics and Incident ResponseApache-2.014 stars
- No published releases
Inactive last commit 930 days ago
Commits in 0 of the last 52 weeks
-
Center for Threat Informed Defense Security Stack Mappings
center-for-threat-informed-defense/security-stack-mappings
🚨ATTENTION🚨 The Security Stack Mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
Detection engineeringDetection Content & SignaturesApache-2.0Release v1.1.0, Sep 21, 2021388 stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 949 days ago
Commits in 0 of the last 52 weeks
-
Linux Expl0rer
Easy-to-use live forensics toolbox for Linux endpoints
Digital forensicsLive ForensicsApache-2.0403 stars
- No published releases
Archived archived by the owner, last commit 980 days ago
Commits in 0 of the last 52 weeks
-
aws-incident-response
easttimor/aws-incident-response
Cloud securityDigital Forensics and Incident ResponseMIT378 stars
- No published releases
Inactive last commit 989 days ago
Commits in 0 of the last 52 weeks
-
threatnote
DefensePointSecurity/threat_note
DPS' Lightweight Investigation Notebook
Incident responseIncident ManagementApache-2.0432 stars
- Listed as defpoint/threat_note, since renamed or moved
- No published releases
Archived archived by the owner, last commit 1043 days ago
Commits in 0 of the last 52 weeks
-
MalConfScan
Volatility plugin for extracts configuration data of known malware
Incident responseMemory Analysis ToolsLicense: otherRelease v1.0.5, Aug 31, 2021498 stars
Inactive last commit 1053 days ago
Commits in 0 of the last 52 weeks
-
SysmonSearch
Investigate suspicious activity by visualizing Sysmon's event log
Incident responseLog Analysis ToolsLicense: otherRelease v2.0, Apr 30, 2020432 stars
Inactive last commit 1053 days ago
Commits in 0 of the last 52 weeks
-
sysmon-DFIR
Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
Detection engineeringConfigurationGPL-3.0947 stars
- No published releases
Inactive last commit 1062 days ago
Commits in 0 of the last 52 weeks
-
MAGNET DumpIt
Memory acquisition for Linux that makes sense.
Incident responseLinux Evidence CollectionApache-2.0258 stars
- No published releases
Inactive last commit 1084 days ago
Commits in 0 of the last 52 weeks
-
Deepfence PacketStreamer
:star: :star: Distributed tcpdump for cloud native environments :star: :star:
Network monitoringFull Packet Capture / ForensicApache-2.0Release v0.1.0, Jun 23, 20221.9K stars
Archived archived by the owner, last commit 1116 days ago
Commits in 0 of the last 52 weeks
-
inVtero.net
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
Incident responseMemory Analysis ToolsAGPL-3.0Release CORE-0.1, Aug 28, 2017296 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 1136 days ago
Commits in 0 of the last 52 weeks
-
hashlookup-forensic-analyser
hashlookup/hashlookup-forensic-analyser
Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - https://circl.lu/services/hashlookup/
Digital forensicsFrameworksLicense: otherRelease v1.3, Sep 24, 2023130 stars
Inactive last commit 1142 days ago
Commits in 0 of the last 52 weeks
-
VirtualDeobfuscator
Reverse engineering tool for virtualization wrappers
Malware analysisDeobfuscation151 stars
- No license file
- No published releases
Inactive last commit 1158 days ago
Commits in 0 of the last 52 weeks
-
Billing Alerts CFN templates
Cloud securityContinuous Security AuditingMIT74 stars
- No published releases
Inactive last commit 1190 days ago
Commits in 0 of the last 52 weeks
-
Diffy
:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
Cloud securityDigital Forensics and Incident ResponseApache-2.0631 stars
- No published releases
Inactive last commit 1202 days ago
Commits in 0 of the last 52 weeks
-
python-evt
Pure Python parser for classic Windows Event Log files (.evt)
Digital forensicsWindows ArtifactsApache-2.051 stars
- No published releases
Inactive last commit 1227 days ago
Commits in 0 of the last 52 weeks
-
Hfinger
Hfinger - fingerprinting HTTP requests
Network monitoringFingerprinting ToolsGPL-3.0Release v0.2.2, May 16, 2023148 stars
Inactive last commit 1273 days ago
Commits in 0 of the last 52 weeks
-
GOSINT
The GOSINT framework is a project used for collecting, processing, and exporting high quality indicators of compromise (IOCs).
Threat intelligenceToolsBSD-3-Clause556 stars
- No published releases
Archived archived by the owner, last commit 1279 days ago
Commits in 0 of the last 52 weeks
-
Bearded Avenger
CIF v3 -- the fastest way to consume threat intelligence
Threat intelligenceFrameworks and PlatformsMPL-2.0Release 3.1.0, Mar 10, 2021186 stars
Archived archived by the owner, last commit 1298 days ago
Commits in 0 of the last 52 weeks
-
APFS Fuse
FUSE driver for APFS (Apple File System)
Digital forensicsOS X ForensicsGPL-2.02.2K stars
- No published releases
Inactive last commit 1337 days ago
Commits in 0 of the last 52 weeks
-
MutableSecurity
MutableSecurity/mutablesecurity
CLI program for automating the setup, configuration, and use of cybersecurity solutions
Incident responseAll-In-One ToolsMITRelease v0.4.0, Oct 22, 202250 stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 1365 days ago
Commits in 0 of the last 52 weeks
-
FireHOL IP Aggregator
spacepatcher/firehol-ip-aggregator
App for storing FireHOL feeds (https://github.com/firehol/blocklist-ipsets) with a history of adding and removing each address
Threat intelligenceToolsApache-2.0Release v2.0.1, Feb 2, 201935 stars
Inactive last commit 1405 days ago
Commits in 0 of the last 52 weeks
-
ElastAlert
Easy & Flexible Alerting With ElasticSearch
Detection engineeringDetection, Alerting and Automation PlatformsApache-2.0Release v0.0.52, Jun 25, 20158K stars
- Listed as Yelp/elastalert, since renamed or moved
Inactive last commit 1458 days ago
Commits in 0 of the last 52 weeks
-
Elastalert | Yelp
Easy & Flexible Alerting With ElasticSearch
Detection engineeringLogging, Monitoring & Data SourcesApache-2.0Release v0.0.52, Jun 25, 20158K stars
Inactive last commit 1458 days ago
Commits in 0 of the last 52 weeks
-
AppMon
Documentation:
Penetration testingMobile Penetration TestingApache-2.0Release 0.5, Feb 12, 20181.6K stars
Archived archived by the owner, last commit 1461 days ago
Commits in 0 of the last 52 weeks
-
Aurora Incident Response
cyb3rfox/Aurora-Incident-Response
Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders
Incident responseTimeline ToolsApache-2.0Release 0.6.6, Mar 29, 20211.1K stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 1475 days ago
Commits in 0 of the last 52 weeks
-
OneMillion
Determine if a domain is in the Alexa or Cisco top one million domain list.
Threat intelligenceToolsMIT8 stars
- No published releases
Inactive last commit 1482 days ago
Commits in 0 of the last 52 weeks
-
Netdiscover
netdiscover
Penetration testingActive Information GatheringGPL-3.0409 stars
- No published releases
Inactive last commit 1489 days ago
Commits in 0 of the last 52 weeks
-
impfuzzy
Fuzzy Hash calculated from import API of PE files
Malware analysisFile SignatureGPL-2.091 stars
- No published releases
Inactive last commit 1536 days ago
Commits in 0 of the last 52 weeks
-
zeek2es
A Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio. This app can also output pure JSON logs to stdout for further processing!
Network monitoringIDS / IPS / Host IDS / Host IPSBSD-3-ClauseRelease v0.3.15, Aug 18, 202241 stars
Inactive last commit 1544 days ago
Commits in 0 of the last 52 weeks
-
StreamAlert
StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
Incident responseLog Analysis ToolsApache-2.0Release v3.5.0, Nov 4, 20212.9K stars
Inactive last commit 1572 days ago
Commits in 0 of the last 52 weeks
-
Andriller
📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
Digital forensicsMobile ForensicsMITRelease 3.6.3, Apr 30, 20221.6K stars
Inactive last commit 1595 days ago
Commits in 0 of the last 52 weeks
-
AChoir
Windows Live Artifacts Acquisition Script
Incident responseWindows Evidence CollectionGPL-2.0Release 4.4a, Aug 8, 2020194 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 1602 days ago
Commits in 0 of the last 52 weeks
-
MISP-Taxii-Server
An OpenTAXII Configuration for MISP
Threat intelligenceToolsBSD-3-Clause87 stars
- No published releases
Inactive last commit 1609 days ago
Commits in 0 of the last 52 weeks
-
BlueBox
BlueBox Malware analysis Box and Cyber threat intelligence.
Threat intelligenceTools49 stars
- No license file
- No published releases
Inactive last commit 1667 days ago
Commits in 0 of the last 52 weeks
-
FATT
FATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic
Network monitoringFingerprinting ToolsBSD-3-Clause687 stars
- No published releases
Inactive last commit 1692 days ago
Commits in 0 of the last 52 weeks
-
Invoke-LiveResponse
Invoke-LiveResponse
Incident responseWindows Evidence CollectionMIT152 stars
- No published releases
Inactive last commit 1721 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 1731 days ago
Commits in 0 of the last 52 weeks
-
OpenBackupExtractor
A free program for extracting data (like voicemails) from iPhone and iPad backups.
Digital forensicsMobile ForensicsGPL-3.0Release 1.1, Mar 21, 2018190 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 1768 days ago
Commits in 0 of the last 52 weeks
-
Pafish
Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do
Malware analysisAnti-Analysis DetectorGPL-3.0Release v0.6, Nov 9, 20213.9K stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 1825 days ago
Commits in 0 of the last 52 weeks
-
MozDef
DEPRECATED - MozDef: Mozilla Enterprise Defense Platform
Incident responseAll-In-One ToolsMPL-2.0Release v3.1.2, Oct 4, 20192.2K stars
Archived archived by the owner, last commit 1832 days ago
Commits in 0 of the last 52 weeks
-
sysmon-config
Sysmon configuration file template with default high-quality event tracing
Detection engineeringConfiguration5.7K stars
- No license file
- No published releases
Inactive last commit 1849 days ago
Commits in 0 of the last 52 weeks
-
CyLR
CyLR - Live Response Collection Tool
Incident responseEvidence CollectionGPL-3.0Release 2.2.0, Feb 3, 2021740 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 1853 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 1864 days ago
Commits in 0 of the last 52 weeks
-
cabby
TAXII client implementation from EclecticIQ
Threat intelligenceToolsLicense: other104 stars
- No published releases
Inactive last commit 1892 days ago
Commits in 0 of the last 52 weeks
-
Repokid Least Privilege
AWS Least Privilege for Distributed, High-Velocity Deployment
Cloud securityContinuous Security AuditingApache-2.0Release v0.19.8, Aug 25, 20211.1K stars
Inactive last commit 1901 days ago
Commits in 0 of the last 52 weeks
-
PEframe
PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.
Malware analysisDetection and ClassificationRelease 6.0.3, Jul 3, 2019628 stars
- No license file
Inactive last commit 1932 days ago
Commits in 0 of the last 52 weeks
-
AWS IR
Python installable command line utiltity for mitigation of host and key compromises.
Cloud securityDigital Forensics and Incident ResponseMITRelease v0.3.2, Jul 8, 2018341 stars
Inactive last commit 1943 days ago
Commits in 0 of the last 52 weeks
-
SyntheticSun
SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats.
Cloud securityContinuous Security AuditingGPL-3.082 stars
- No published releases
Inactive last commit 1950 days ago
Commits in 0 of the last 52 weeks
-
Disable keys after X days
A small lambda script that will disable access keys older than a given amount of days.
Cloud securityContinuous Security AuditingISCRelease 1.1.2, Mar 14, 2018154 stars
Inactive last commit 1952 days ago
Commits in 0 of the last 52 weeks
-
VolatilityBot
VolatilityBot – An automated memory analyzer for malware samples and memory dumps
Incident responseMemory Analysis ToolsMIT269 stars
- No published releases
Inactive last commit 1973 days ago
Commits in 0 of the last 52 weeks
-
jager
Hunting IOCs all day every day...
Threat intelligenceToolsLicense: other87 stars
- No published releases
Inactive last commit 2000 days ago
Commits in 0 of the last 52 weeks
-
cloudtrail-partitioner
duo-labs/cloudtrail-partitioner
Cloud securityDigital Forensics and Incident ResponseBSD-3-ClauseRelease 1.0.0.1, Apr 23, 2020159 stars
Inactive last commit 2008 days ago
Commits in 0 of the last 52 weeks
-
Cuckoo Sandbox
Cuckoo Sandbox is an automated dynamic malware analysis system
Malware analysisDynamic Analysis ToolsLicense: otherRelease 2.0.6, Jun 7, 20186K stars
Archived archived by the owner, last commit 2022 days ago
Commits in 0 of the last 52 weeks
-
NTFS USN Journal parser
PoorBillionaire/USN-Journal-Parser
Python script to parse the NTFS USN Journal
Digital forensicsNTFS/MFT ProcessingLicense: other118 stars
- No published releases
Inactive last commit 2022 days ago
Commits in 0 of the last 52 weeks
-
libtaxii
A Python library for handling TAXII Messages invoking TAXII Services.
Threat intelligenceToolsBSD-3-ClauseRelease 1.1.119, Apr 15, 202173 stars
Inactive last commit 2028 days ago
Commits in 0 of the last 52 weeks
-
Softrace
Lightweight and fast NSRL RDS storage
Threat intelligenceToolsApache-2.03 stars
- No published releases
Inactive last commit 2049 days ago
Commits in 0 of the last 52 weeks
-
IE10Analyzer
http://moaistory.blogspot.com/2016/08/ie10analyzer.html
Digital forensicsInternet ArtifactsMITRelease 1.0.0.6, Jul 20, 202420 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2071 days ago
Commits in 0 of the last 52 weeks
-
WinSearchDBAnalyzer
http://moaistory.blogspot.com/2018/10/winsearchdbanalyzer.html
Digital forensicsInternet ArtifactsMITRelease 1.0.0.6, Jul 20, 2024134 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2071 days ago
Commits in 0 of the last 52 weeks
-
nsrllookup
Checks with NSRL RDS servers looking for for hash matches
Malware analysisDetection and ClassificationISCRelease 1.4.2, Sep 16, 2019113 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2081 days ago
Commits in 0 of the last 52 weeks
-
ir-rescue
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
Incident responseEvidence CollectionLicense: other487 stars
- No published releases
Inactive last commit 2087 days ago
Commits in 0 of the last 52 weeks
-
Security Monkey
Security Monkey monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.
Cloud securityContinuous Security AuditingApache-2.0Release 1.1.3, May 24, 20184.4K stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 2097 days ago
Commits in 0 of the last 52 weeks
-
FastIR Collector
Incident responseWindows Evidence CollectionGPL-3.0Release V1.1, May 16, 2017515 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2113 days ago
Commits in 0 of the last 52 weeks
-
FastIR Collector Linux
SekoiaLab/Fastir_Collector_Linux
Incident responseLinux Evidence CollectionGPL-3.0177 stars
- No published releases
Inactive last commit 2113 days ago
Commits in 0 of the last 52 weeks
-
Kolide Fleet
A flexible control server for osquery fleets
Detection engineeringEndpoint MonitoringMITRelease 3.2.0, Oct 8, 20201.1K stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 2154 days ago
Commits in 0 of the last 52 weeks
-
dnSpy
.NET debugger and assembly editor
Reverse engineering.NET DecompilersRelease v6.1.8, Dec 7, 202029.7K stars
- No license file
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 2162 days ago
Commits in 0 of the last 52 weeks
-
Stenographer
Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com
Network monitoringNetwork MonitoringApache-2.01.8K stars
- No published releases
Archived archived by the owner, last commit 2169 days ago
Commits in 0 of the last 52 weeks
-
Zeek Agent
This project is no longer maintained. There's a successor at https://github.com/zeek/zeek-agent-v2
Detection engineeringEndpoint MonitoringLicense: other122 stars
- No published releases
Archived archived by the owner, last commit 2181 days ago
Commits in 0 of the last 52 weeks
-
Hoarder
This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.
Incident responseWindows Evidence CollectionGPL-3.0Release 4.0.0, Aug 5, 2020217 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2212 days ago
Commits in 0 of the last 52 weeks
-
Rekall
Rekall Memory Forensic Framework
Digital forensicsMemory ForensicsGPL-2.0Release v1.7.1, Nov 6, 20172K stars
Archived archived by the owner, last commit 2213 days ago
Commits in 0 of the last 52 weeks
-
PrismX
Cloud Security Dashboard for AWS - based on ScoutSuite
Cloud securityContinuous Security AuditingGPL-2.01 stars
- Listed as omaidf/PrismX, since renamed or moved
- No published releases
Inactive last commit 2221 days ago
Commits in 0 of the last 52 weeks
-
aws-fast-fixes
Scripts to quickly fix security and compliance issues
Cloud securityDigital Forensics and Incident ResponseApache-2.0108 stars
- No published releases
Archived archived by the owner, last commit 2247 days ago
Commits in 0 of the last 52 weeks
-
FingerprinTLS
LeeBrotherston/tls-fingerprinting
TLS Fingerprinting
Network monitoringFingerprinting ToolsGPL-3.0Release 1.0.1, Jul 31, 2016399 stars
Archived archived by the owner, last commit 2252 days ago
Commits in 0 of the last 52 weeks
-
aws-auto-remediate
Open source application to instantly remediate common security issues through the use of AWS Config
Cloud securityDigital Forensics and Incident ResponseGPL-3.0Release v1.0, May 20, 2019217 stars
- Listed as servian/aws-auto-remediate, since renamed or moved
Archived archived by the owner, last commit 2257 days ago
Commits in 0 of the last 52 weeks
-
de4dot
.NET deobfuscator and unpacker.
Malware analysisDeobfuscationGPL-3.07.4K stars
- Listed as 0xd4d/de4dot, since renamed or moved
- No published releases
Archived archived by the owner, last commit 2263 days ago
Commits in 0 of the last 52 weeks
-
Sublist3r
Fast subdomains enumeration tool for penetration testers
Penetration testingPenetration TestingGPL-2.0Release 1.1, Apr 6, 202011.1K stars
Inactive last commit 2294 days ago
Commits in 0 of the last 52 weeks
-
OSX Auditor
OS X Auditor is a free Mac OS X computer forensics tool
Incident responseOSX Evidence CollectionLicense: other3.1K stars
- No published releases
Inactive last commit 2295 days ago
Commits in 0 of the last 52 weeks
-
AppCompatProcessor
mbevilacqua/appcompatprocessor
"Evolving AppCompat/AmCache data analysis beyond grep"
Incident responseLog Analysis ToolsApache-2.0216 stars
- No published releases
Inactive last commit 2341 days ago
Commits in 0 of the last 52 weeks
-
MEAT
This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices
Digital forensicsMobile ForensicsGPL-3.0Release v1.0.3, Apr 22, 2020167 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2363 days ago
Commits in 0 of the last 52 weeks
-
RDFP
Remote Desktop Client Fingerprint script for Zeek. Based off of https://github.com/0x4D31/fatt
Network monitoringFingerprinting ToolsApache-2.040 stars
- Listed as yahoo/rdfp, since renamed or moved
- No published releases
Inactive last commit 2368 days ago
Commits in 0 of the last 52 weeks
-
unxor
unXOR will search a XORed file and try to guess the key using known-plaintext attacks.
Malware analysisDeobfuscationApache-2.0144 stars
- No published releases
Inactive last commit 2390 days ago
Commits in 0 of the last 52 weeks
-
Cloud Inquisitor
Enforce ownership and data security within AWS
Cloud securityContinuous Security AuditingApache-2.0Release 2.2.0, Sep 24, 2018445 stars
Archived archived by the owner, last commit 2397 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 2412 days ago
Commits in 0 of the last 52 weeks
-
osquery-configuration
palantir/osquery-configuration
A repository for using osquery for incident detection and response
Detection engineeringConfigurationLicense: other909 stars
- No published releases
Inactive last commit 2418 days ago
Commits in 0 of the last 52 weeks
-
Varna
Varna: Quick & Cheap AWS CloudTrail Monitoring with Event Query Language (EQL)
Cloud securityDigital Forensics and Incident ResponseApache-2.052 stars
- No published releases
Inactive last commit 2463 days ago
Commits in 0 of the last 52 weeks
-
BinaryAlert
BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.
Malware analysisDetection and ClassificationApache-2.0Release v1.2.0, Sep 5, 20181.5K stars
Inactive last commit 2481 days ago
Commits in 0 of the last 52 weeks
-
Cold Disk Quick Response
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
Incident responseEvidence CollectionGPL-3.0Release 20191226, Dec 26, 2019347 stars
- Listed as rough007/CDQR, since renamed or moved
- Latest release has downloads without a signature or checksum file
Inactive last commit 2509 days ago
Commits in 0 of the last 52 weeks
-
GDPatrol
A Lambda-powered Security Orchestration framework for AWS GuardDuty
Cloud securityDigital Forensics and Incident ResponseMIT53 stars
- No published releases
Archived archived by the owner, last commit 2520 days ago
Commits in 0 of the last 52 weeks
-
fargate-ir
Proof of concept incident response demo using SSM and AWS Fargate.
Cloud securityDigital Forensics and Incident ResponseLicense: other15 stars
- No published releases
Inactive last commit 2530 days ago
Commits in 0 of the last 52 weeks
-
Beagle
Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
Digital forensicsWindows ArtifactsMITRelease v1.0.5, May 28, 20191.4K stars
Inactive last commit 2533 days ago
Commits in 0 of the last 52 weeks
-
nightHawk
biggiesmallsAG/nightHawkResponse
Incident Response Forensic Framework
Incident responseAll-In-One ToolsRelease 1.0.3, Sep 1, 2016607 stars
- No license file
Inactive last commit 2546 days ago
Commits in 0 of the last 52 weeks
-
Joy
A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
Network monitoringNetwork MonitoringLicense: other1.4K stars
- No published releases
Archived archived by the owner, last commit 2557 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 2558 days ago
Commits in 0 of the last 52 weeks
-
AbuseHelper
A framework for receiving and redistributing abuse feeds
Threat intelligenceFrameworks and PlatformsMITRelease v5.7.0, Feb 12, 2019122 stars
Inactive last commit 2600 days ago
Commits in 0 of the last 52 weeks
-
CyBot
Open Source Threat Intelligence Chat Bot
Threat intelligenceTools316 stars
- Listed as CylanceSPEAR/CyBot, since renamed or moved
- No license file
- No published releases
Inactive last commit 2609 days ago
Commits in 0 of the last 52 weeks
-
mig
Distributed & real time digital forensics at the speed of the cloud
Digital forensicsLive ForensicsMPL-2.01.2K stars
- No published releases
Archived archived by the owner, last commit 2613 days ago
Commits in 0 of the last 52 weeks
-
SRA TAXII2 Server
SecurityRiskAdvisors/sra-taxii2-server
TAXII 2.0 Server implemented in Node JS with MongoDB backend
Threat intelligenceToolsMIT11 stars
- No published releases
Archived archived by the owner, last commit 2629 days ago
Commits in 0 of the last 52 weeks
-
SSM-Acquire
A python module for orchestrating content acquisitions and analysis via amazon ssm.
Cloud securityDigital Forensics and Incident ResponseMPL-2.058 stars
- No published releases
Inactive last commit 2651 days ago
Commits in 0 of the last 52 weeks
-
Empire
Empire is a PowerShell and Python post-exploitation agent.
Penetration testingPenetration TestingBSD-3-ClauseRelease 2.5, Mar 15, 20187.8K stars
Archived archived by the owner, last commit 2657 days ago
Commits in 0 of the last 52 weeks
-
Hammer
Dow Jones Hammer : Protect the cloud with the power of the cloud(AWS)
Cloud securityContinuous Security AuditingLicense: other449 stars
- No published releases
Inactive last commit 2692 days ago
Commits in 0 of the last 52 weeks
-
dexter
Forensics acquisition framework designed to be extensible and secure
Digital forensicsFrameworksApache-2.0125 stars
- No published releases
Inactive last commit 2697 days ago
Commits in 0 of the last 52 weeks
-
OSX Collect
A forensic evidence collection & analysis toolkit for OS X
Digital forensicsOS X ForensicsLicense: otherRelease v1.10, Jun 15, 20181.9K stars
Archived archived by the owner, last commit 2699 days ago
Commits in 0 of the last 52 weeks
-
OSX Collector
A forensic evidence collection & analysis toolkit for OS X
Incident responseOSX Evidence CollectionLicense: otherRelease v1.10, Jun 15, 20181.9K stars
- Listed as yelp/osxcollector, since renamed or moved
Archived archived by the owner, last commit 2699 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 2720 days ago
Commits in 0 of the last 52 weeks
-
Archived archived by the owner, last commit 2728 days ago
Commits in 0 of the last 52 weeks
-
YETI
YETI is a TAXII implementation
Threat intelligenceToolsBSD-3-Clause46 stars
- No published releases
Archived archived by the owner, last commit 2739 days ago
Commits in 0 of the last 52 weeks
-
pehash
Compilation of peHash implementations.
Malware analysisFile SignatureRelease v0.9.0, Sep 27, 201715 stars
- No license file
Inactive last commit 2748 days ago
Commits in 0 of the last 52 weeks
-
AWSlog
Show the history and changes between configuration versions of AWS resources
Cloud securityDigital Forensics and Incident ResponseMIT70 stars
- No published releases
Archived archived by the owner, last commit 2788 days ago
Commits in 0 of the last 52 weeks
-
Krampus
The original AWS security enforcer™
Cloud securityContinuous Security AuditingMIT62 stars
- No published releases
Inactive last commit 2805 days ago
Commits in 0 of the last 52 weeks
-
Lorg
Apache Logfile Security Analyzer
Incident responseLog Analysis ToolsGPL-2.0214 stars
- No published releases
Inactive last commit 2817 days ago
Commits in 0 of the last 52 weeks
-
Scumblr
Web framework that allows performing periodic syncs of data sources and performing analysis on the identified results
Threat intelligenceFrameworks and PlatformsApache-2.0Release 2.1.0, Sep 25, 20172.6K stars
- Listed as Netflix/Scumblr, since renamed or moved
Inactive last commit 2833 days ago
Commits in 0 of the last 52 weeks
-
File Scanning Framework
File Scanning Framework
Malware analysisDetection and ClassificationApache-2.0293 stars
- No published releases
Inactive last commit 2841 days ago
Commits in 0 of the last 52 weeks
-
MultiScanner
Modular file scanning/analysis framework
Malware analysisDetection and ClassificationLicense: otherRelease 2.0.0, Jan 28, 2019620 stars
Inactive last commit 2842 days ago
Commits in 0 of the last 52 weeks
-
Doorman
an osquery fleet manager
Incident responseAll-In-One ToolsMITRelease v0.6, Sep 5, 2017621 stars
Inactive last commit 2865 days ago
Commits in 0 of the last 52 weeks
-
ManaTI
A web-based tool to assist the work of the intuitive threat analysts.
Threat intelligenceFrameworks and PlatformsRelease v0.12.2a, Nov 11, 2018112 stars
- No license file
Inactive last commit 2865 days ago
Commits in 0 of the last 52 weeks
-
aws-logsearch
Cloud securityDigital Forensics and Incident ResponseMITRelease 0.0.1, Dec 10, 201825 stars
Inactive last commit 2890 days ago
Commits in 0 of the last 52 weeks
-
GoatRider
GoatRider is a simple tool that will dynamically pull down Artillery Threat Intelligence Feeds, TOR, AlienVaults OTX, and the Alexa top 1 million websites and do a comparison to a hostname file or IP file.
Threat intelligenceToolsLicense: other142 stars
- No published releases
Inactive last commit 2910 days ago
Commits in 0 of the last 52 weeks
-
MalPipe
Malware/IOC ingestion and processing engine
Threat intelligenceToolsGPL-3.0108 stars
- No published releases
Inactive last commit 2910 days ago
Commits in 0 of the last 52 weeks
-
iOS Frequent Locations Dumper
mac4n6/iOS-Frequent-Locations-Dumper
Dump the iOS Frequent Location binary plist files
Digital forensicsMobile Forensics91 stars
- No license file
- No published releases
Inactive last commit 2926 days ago
Commits in 0 of the last 52 weeks
-
Hippocampe
Threat Feed Aggregation, Made Easy
Threat intelligenceToolsAGPL-3.0Release 1.0.0, Jan 18, 2017168 stars
Archived archived by the owner, last commit 2943 days ago
Commits in 0 of the last 52 weeks
-
openioc-to-stix
Generate STIX XML from OpenIOC XML
Threat intelligenceToolsBSD-3-ClauseRelease v1.4.0, Oct 17, 201896 stars
Inactive last commit 2944 days ago
Commits in 0 of the last 52 weeks
-
Generic File Parser
A Single Library Parser to extract meta information,static analysis and detect macros within the files.
Malware analysisDetection and ClassificationMIT3 stars
- No published releases
Inactive last commit 2978 days ago
Commits in 0 of the last 52 weeks
-
Laika BOSS
Laika BOSS: Object Scanning System
Digital forensicsFrameworksApache-2.0752 stars
- No published releases
Inactive last commit 2980 days ago
Commits in 0 of the last 52 weeks
-
MacLocationsScraper
macOS/iOS database location scraper to extract location data
Digital forensicsOS X Forensics91 stars
- No license file
- No published releases
Inactive last commit 2984 days ago
Commits in 0 of the last 52 weeks
-
Watchmen
(Not maintained anymore) Watchmen - AWS account compliance using centrally managed Config Rules
Cloud securityContinuous Security AuditingApache-2.0175 stars
- No published releases
Inactive last commit 2987 days ago
Commits in 0 of the last 52 weeks
-
Hiryu
IOC Management and Visualization Tool
Threat intelligenceTools48 stars
- No license file
- No published releases
Inactive last commit 2991 days ago
Commits in 0 of the last 52 weeks
-
Yara Finder
Simple tool to find the yara matches on a file
Malware analysisDetection and ClassificationMITRelease 1.0.0, Aug 24, 20182 stars
Inactive last commit 2995 days ago
Commits in 0 of the last 52 weeks
-
rastrea2r
Collecting & Hunting for IOCs with gusto and style
Threat intelligenceTools117 stars
- No license file
- No published releases
Inactive last commit 3013 days ago
Commits in 0 of the last 52 weeks
-
cacador
Indicator Extractor
Threat intelligenceToolsMITRelease v0.0.1, Apr 3, 2016139 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 3040 days ago
Commits in 0 of the last 52 weeks
-
Threat-Intelligence-Hunter
abhinavbom/Threat-Intelligence-Hunter
TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own local database of indicators.
Threat intelligenceToolsMIT155 stars
- No published releases
Inactive last commit 3044 days ago
Commits in 0 of the last 52 weeks
-
Margarita Shotgun
ThreatResponse/margaritashotgun
Remote Memory Acquisition Tool
Incident responseEvidence CollectionMITRelease v0.4.1, Jul 21, 2017250 stars
Inactive last commit 3064 days ago
Commits in 0 of the last 52 weeks
-
NoMoreXOR
Tool to help guess a files 256 byte XOR key by using frequency analysis
Malware analysisDeobfuscation88 stars
- No license file
- No published releases
Inactive last commit 3073 days ago
Commits in 0 of the last 52 weeks
-
PowerForensics
PowerForensics provides an all in one platform for live disk forensic analysis
Incident responseWindows Evidence CollectionMITRelease 1.1.1, Jan 30, 20161.4K stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 3125 days ago
Commits in 0 of the last 52 weeks
-
poortego
Open-source python project to handle the storage and linking of open-source intelligence (ala Maltego)
Threat intelligenceToolsMIT121 stars
- No published releases
Inactive last commit 3133 days ago
Commits in 0 of the last 52 weeks
-
PackerAttacker
C++ application that uses memory and code hooks to detect packers
Malware analysisDeobfuscationGPL-2.0273 stars
- No published releases
Inactive last commit 3171 days ago
Commits in 0 of the last 52 weeks
-
Malstrom
Cyber Intel Management
Threat intelligenceFrameworks and PlatformsMIT49 stars
- Listed as byt3smith/malstrom, since renamed or moved
- No published releases
Archived archived by the owner, last commit 3209 days ago
Commits in 0 of the last 52 weeks
-
Forager
Multithreaded threat Intelligence gathering built with Python3
Threat intelligenceToolsMITRelease v2.0.3, Apr 12, 2016176 stars
- Listed as byt3smith/Forager, since renamed or moved
Inactive last commit 3211 days ago
Commits in 0 of the last 52 weeks
-
Archived archived by the owner, last commit 3254 days ago
Commits in 0 of the last 52 weeks
-
macMRUParser
Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format.
Digital forensicsOS X Forensics110 stars
- No license file
- No published releases
Inactive last commit 3255 days ago
Commits in 0 of the last 52 weeks
-
Evolve
Web interface for the Volatility Memory Forensics Framework
Incident responseMemory Analysis ToolsRelease v1.6, Nov 16, 2017257 stars
- No license file
Inactive last commit 3275 days ago
Commits in 0 of the last 52 weeks
-
CimSweep
CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
Incident responseAll-In-One ToolsBSD-3-ClauseRelease v0.6.1.1, Jun 8, 2017656 stars
- Listed as PowerShellMafia/CimSweep, since renamed or moved
Inactive last commit 3338 days ago
Commits in 0 of the last 52 weeks
-
VolDiff
VolDiff: Malware Memory Footprint Analysis based on Volatility
Incident responseMemory Analysis ToolsBSD-2-ClauseRelease v2.1, Jun 18, 2015194 stars
- Listed as aim4r/VolDiff, since renamed or moved
Archived archived by the owner, last commit 3344 days ago
Commits in 0 of the last 52 weeks
-
python-ntfs
Open source Python library for NTFS analysis
Digital forensicsNTFS/MFT ProcessingApache-2.085 stars
- No published releases
Inactive last commit 3352 days ago
Commits in 0 of the last 52 weeks
-
ActorTrackr
Home to the ActorTrackr source code
Threat intelligenceToolsLicense: other30 stars
- Fork of another repository
- No published releases
Inactive last commit 3357 days ago
Commits in 0 of the last 52 weeks
-
hashdeep
Malware analysisDetection and ClassificationLicense: otherRelease v4.4, Jan 29, 2014792 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 3363 days ago
Commits in 0 of the last 52 weeks
-
PSRecon
:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
Incident responseWindows Evidence CollectionApache-2.0493 stars
- No published releases
Inactive last commit 3389 days ago
Commits in 0 of the last 52 weeks
-
threatcmd
Cli interface to threatcrowd.org
Threat intelligenceToolsMIT20 stars
- No published releases
Inactive last commit 3412 days ago
Commits in 0 of the last 52 weeks
-
threatcrowdapi
Python wrapper for threatcrowd's api
Threat intelligenceToolsMIT9 stars
- No published releases
Inactive last commit 3412 days ago
Commits in 0 of the last 52 weeks
-
iocparser
Tool to extract indicators of compromise from security reports in PDF format
Threat intelligenceToolsMIT437 stars
- No published releases
Inactive last commit 3434 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 3451 days ago
Commits in 0 of the last 52 weeks
-
CIRTkit
Tools for the Computer Incident Response Team :computer:
Incident responseAll-In-One ToolsMIT153 stars
- Listed as byt3smith/CIRTKit, since renamed or moved
- No published releases
Inactive last commit 3492 days ago
Commits in 0 of the last 52 weeks
-
Megatron
Megatron - A System for Abuse- and Incident Handling
Threat intelligenceFrameworks and PlatformsApache-2.0Release v.1.1.1, Mar 29, 201744 stars
Inactive last commit 3512 days ago
Commits in 0 of the last 52 weeks
-
Lazy Office Analyzer
Lazy Office Analyzer
Malware analysisMicrosoft Office122 stars
- No license file
- No published releases
Inactive last commit 3553 days ago
Commits in 0 of the last 52 weeks
-
Panorama
Fast incident overview
Incident responseWindows Evidence Collection41 stars
- No license file
- No published releases
Inactive last commit 3558 days ago
Commits in 0 of the last 52 weeks
-
VolUtility
Web App for Volatility framework
Digital forensicsMemory ForensicsGPL-3.0Release v1.2, Jan 3, 2017388 stars
Inactive last commit 3580 days ago
Commits in 0 of the last 52 weeks
-
pee-pdf
Powerful Python tool to analyze PDF documents
Malware analysisPDFGPL-3.01.5K stars
- No published releases
Inactive last commit 3643 days ago
Commits in 0 of the last 52 weeks
-
stix-viz
STIX Visualization Tool
Threat intelligenceToolsBSD-3-ClauseRelease v1.0.7a, Jul 13, 2018112 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 3700 days ago
Commits in 0 of the last 52 weeks
-
HashCheck
HashCheck Shell Extension for Windows with added SHA2, SHA3, and multithreading; originally from code.kliu.org
Malware analysisDetection and ClassificationLicense: otherRelease v2.4.0, Sep 7, 20162.1K stars
- Latest release has a checksum file but no signature
Inactive last commit 3714 days ago
Commits in 0 of the last 52 weeks
-
ibmxforceex.checker.py
johestephan/ibmxforceex.checker.py
Python based client for IBM XForce Exchange
Threat intelligenceToolsApache-2.025 stars
- No published releases
Archived archived by the owner, last commit 3748 days ago
Commits in 0 of the last 52 weeks
-
Combine
Tool to gather Threat Intelligence indicators from publicly available sources
Threat intelligenceToolsGPL-3.0Release v0.1.3, Apr 27, 2015654 stars
Inactive last commit 3757 days ago
Commits in 0 of the last 52 weeks
-
Automater
Automater - IP URL and MD5 OSINT Analysis
Threat intelligenceToolsMIT556 stars
- No published releases
Inactive last commit 3814 days ago
Commits in 0 of the last 52 weeks
-
QRadio
QRadio ~ Best Threat Intelligence Radio ~ Tune In!
Threat intelligenceToolsApache-2.0Release v1.4.0, Mar 9, 201699 stars
Inactive last commit 3824 days ago
Commits in 0 of the last 52 weeks
-
dff
DFF (Digital Forensics Framework) is a Forensics Framework coming with command line and graphical interfaces. DFF can be used to investigate hard drives and volatile memory and create reports about user and system activities.
Digital forensicsFrameworksGPL-2.0Release 1.4.0, Feb 13, 2020318 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 3826 days ago
Commits in 0 of the last 52 weeks
-
IRTriage
Incident Response Triage - Windows Evidence Collection for Forensic Analysis
Incident responseWindows Evidence Collection139 stars
- No license file
- No published releases
Inactive last commit 3854 days ago
Commits in 0 of the last 52 weeks
-
unpacker
Automated malware unpacker
Malware analysisDeobfuscation121 stars
- No license file
- No published releases
Inactive last commit 3901 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 3966 days ago
Commits in 0 of the last 52 weeks
-
Malfunction
Malware Analysis Tool using Function Level Fuzzy Hashing
Malware analysisDetection and ClassificationLGPL-2.1190 stars
- No published releases
Inactive last commit 3981 days ago
Commits in 0 of the last 52 weeks
-
Harbinger Threat Intelligence
Harbinger Threat Intelligence
Threat intelligenceTools81 stars
- No license file
- No published releases
Archived archived by the owner, last commit 3988 days ago
Commits in 0 of the last 52 weeks
-
bro-intel-generator
Script for generating Bro intel files from pdf or html reports
Threat intelligenceToolsMIT75 stars
- No published releases
Archived archived by the owner, last commit 3990 days ago
Commits in 0 of the last 52 weeks
-
KeeFarce
Extracts passwords from a KeePass 2.x database, directly from memory.
Digital forensicsMemory ForensicsBSD-3-Clause1K stars
- No published releases
Inactive last commit 4010 days ago
Commits in 0 of the last 52 weeks
-
tiq-test
Threat Intelligence Quotient Test - Dataviz and Statistical Analysis of TI feeds
Threat intelligenceToolsGPL-3.0Release v0.2.0, Feb 1, 2015176 stars
Inactive last commit 4039 days ago
Commits in 0 of the last 52 weeks
-
MASTIFF
Malware static analysis framework
Malware analysisDetection and Classification184 stars
- No license file
- No published releases
Archived archived by the owner, last commit 4065 days ago
Commits in 0 of the last 52 weeks
-
TARDIS
Threat Analysis, Reconnaissance, and Data Intelligence System
Threat intelligenceFrameworks and PlatformsApache-2.0124 stars
- No published releases
Inactive last commit 4090 days ago
Commits in 0 of the last 52 weeks
-
PyIOCe
Python IOC Editor
Threat intelligenceToolsApache-2.065 stars
- Listed as yahoo/PyIOCe, since renamed or moved
- No published releases
Archived archived by the owner, last commit 4262 days ago
Commits in 0 of the last 52 weeks
-
ThreatTracker
ThreatTracker is a Python script designed to monitor and generate alerts on given sets of indicators of compromise (IOCs) indexed by a set of Google Custom Search Engines.
Threat intelligenceTools70 stars
- No license file
- No published releases
Inactive last commit 4262 days ago
Commits in 0 of the last 52 weeks
-
dnsenum
dnsenum is a perl script that enumerates DNS information
Penetration testingActive Information GatheringRelease 1.2.4.2, Feb 20, 2015712 stars
- No license file
Inactive last commit 4279 days ago
Commits in 0 of the last 52 weeks
-
Threatelligence
Threatelligence is a simple cyber threat intelligence feed collector, using Elasticsearch, Kibana and Python to automatically collect intelligence from custom or public sources. Automatically updates feeds and tries to further enhance data for dashboards.
Threat intelligenceTools151 stars
- No license file
- No published releases
Archived archived by the owner, last commit 4541 days ago
Commits in 0 of the last 52 weeks
-
CrowdFMS
CrowdStrike Feed Management System. CrowdFMS is a framework for automating collection and processing of samples from VirusTotal, by leveraging the Private API system. This framework automatically downloads recent samples, which triggered an alert on the users YARA notification feed.
Threat intelligenceToolsBSD-2-Clause132 stars
- No published releases
Archived archived by the owner, last commit 4651 days ago
Commits in 0 of the last 52 weeks
-
AnalyzePE
Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.
Malware analysisDetection and Classification211 stars
- No license file
- No published releases
Inactive last commit 4672 days ago
Commits in 0 of the last 52 weeks
-
IOCextractor
IOC (Indicator of Compromise) Extractor: a program to help extract IOCs from text files.
Threat intelligenceTools134 stars
- No license file
- No published releases
Inactive last commit 4793 days ago
Commits in 0 of the last 52 weeks
-
sshwatch
Intrusion Prevention System (IPS) for Secure Shell (SSH)
Network monitoringIDS / IPS / Host IDS / Host IPS56 stars
- No license file
- No published releases
Inactive last commit 4858 days ago
Commits in 0 of the last 52 weeks
-
Unavailable the repository was deleted or made private
-
Exabeam Content Library
ExabeamLabs/Content-Library-CIM2
Detection engineeringDetection Content & Signatures
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
No tools match these filters.