Open-source security tools and whether they are still maintained
368 tools from 9 curated lists, checked against the GitHub API on Oct 20, 2026.
The weekly check has not run since Oct 20, 2026. Status is recalculated from the last known commit dates.
-
Agent Threat Rules (ATR)
Agent-Threat-Rule/agent-threat-rules
Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.
Detection engineeringDetection Content & SignaturesMITRelease pyatr-v0.3.1, Oct 15, 2026418 stars
Active last commit today
Commits in 33 of the last 52 weeks
-
ALEAPP
Android Logs Events And Protobuf Parser
Digital forensicsMobile ForensicsMITRelease v2026.4.3, Oct 2, 20261K stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 45 of the last 52 weeks
-
Arkime
Arkime is an open source, large scale, full packet capturing, indexing, and database system.
Network monitoringNetwork MonitoringApache-2.0Release v6.8.0, Sep 30, 20267.5K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 50 of the last 52 weeks
-
AVML
AVML - Acquire Volatile Memory for Linux
Incident responseMemory Analysis ToolsMITRelease v0.21.0, Oct 9, 20261.1K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 26 of the last 52 weeks
-
CloudQuery
Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.
Cloud securityContinuous Security AuditingMPL-2.0Release cli-v6.49.0, Oct 19, 20266.5K stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 52 of the last 52 weeks
-
CrowdSec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Network monitoringIDS / IPS / Host IDS / Host IPSMITRelease v1.8.1, Sep 3, 202615.2K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 45 of the last 52 weeks
-
Detect-It-Easy
Program for determining types of files for Windows, Linux and MacOS.
Malware analysisFile IdentificationMIT11.8K stars
- No published releases
Active last commit today
Commits in 52 of the last 52 weeks
-
Elastic Detection Rules
Detection engineeringDetection RulesLicense: otherRelease dev-v3.0.0, Sep 25, 20262.7K stars
Active last commit today
Commits in 51 of the last 52 weeks
-
flare-floss
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Malware analysisStringsApache-2.0Release v3.2.0, Oct 16, 20264.2K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 40 of the last 52 weeks
-
Fleetdm
Open device management
Incident responseAll-In-One ToolsLicense: otherRelease fleet-v4.93.0, Oct 8, 20267K stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 52 of the last 52 weeks
-
FLOSS
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Malware analysisDeobfuscationApache-2.0Release v3.2.0, Oct 16, 20264.2K stars
- Listed as fireeye/flare-floss, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 40 of the last 52 weeks
-
iLEAPP
iOS Logs, Events, And Plist Parser
Digital forensicsMobile ForensicsMITRelease v2026.4.4, Oct 2, 20261.4K stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 50 of the last 52 weeks
-
ILSpy
.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
Reverse engineering.NET DecompilersMITRelease v11.1, Sep 23, 202626.7K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 48 of the last 52 weeks
-
Moloch
Arkime is an open source, large scale, full packet capturing, indexing, and database system.
Network monitoringFull Packet Capture / ForensicApache-2.0Release v6.8.0, Sep 30, 20267.5K stars
- Listed as aol/moloch, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 50 of the last 52 weeks
-
Nauz File Detector(NFD)
Linker/Compiler/Tool detector for Windows, Linux and MacOS.
Malware analysisDetection and ClassificationMITRelease 0.09, Oct 26, 2022585 stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 51 of the last 52 weeks
-
ntopng
Web-based Traffic and Cybersecurity Network Traffic Monitoring
Network monitoringNetwork MonitoringGPL-3.0Release 7.0, Sep 22, 20268.3K stars
Active last commit today
Commits in 52 of the last 52 weeks
-
RSigma | Timescale
A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:
Detection engineeringDetection Content & SignaturesMITRelease v0.25.0, Oct 19, 2026169 stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 32 of the last 52 weeks
-
Rustinel | Karib0u
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
Detection engineeringLogging, Monitoring & Data SourcesApache-2.0Release v1.10.0, Oct 16, 2026507 stars
Active last commit today
Commits in 31 of the last 52 weeks
-
Sigma
Main Sigma Rule Repository
Incident responseLog Analysis ToolsLicense: otherRelease r2026-07-01, Jul 9, 202611.3K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 46 of the last 52 weeks
-
Splunk Security Content
Splunk Security Content
Detection engineeringDetection Content & SignaturesApache-2.0Release v6.8.0, Oct 7, 20261.7K stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 50 of the last 52 weeks
-
Sublime
sublime-security/sublime-platform
A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, collaborate with the community, and write detections-as-code.
Detection engineeringDetection, Alerting and Automation PlatformsMIT276 stars
- No published releases
Active last commit today
Commits in 23 of the last 52 weeks
-
Sublime Detection Rules
sublime-security/sublime-rules
Sublime rules for email attack detection, prevention, and threat hunting.
Detection engineeringDetection RulesMIT380 stars
- No published releases
Active last commit today
Commits in 51 of the last 52 weeks
-
UFADE
Extract files from Apple devices on Windows, Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and "advanced logical backups"
Digital forensicsAcquisitionGPL-3.0Release v1.0.5, Oct 16, 2026585 stars
- Latest release has downloads without a signature or checksum file
Active last commit today
Commits in 22 of the last 52 weeks
-
VAST
Tenzir is the data pipeline engine for security teams.
Network monitoringMonitoring / LoggingBSD-3-ClauseRelease v6.19.1, Sep 30, 2026765 stars
- Listed as tenzir/vast, since renamed or moved
- Latest release has a checksum file but no signature
Active last commit today
Commits in 52 of the last 52 weeks
-
WAZUH
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Detection engineeringEndpoint MonitoringLicense: otherRelease v4.14.9, Oct 15, 202617.3K stars
Active last commit today
Commits in 52 of the last 52 weeks
-
Zeek
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
Network monitoringNetwork MonitoringLicense: otherRelease v9.0.0, Aug 21, 20268.1K stars
Active last commit today
Commits in 51 of the last 52 weeks
-
Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
Incident responseLog Analysis ToolsLicense: otherRelease v4.6.0, Oct 18, 2026863 stars
- Latest release has a checksum file but no signature
Active last commit today
Commits in 26 of the last 52 weeks
-
Cynative
Open-source AI agent framework for cloud security across AWS, Azure, GCP and Kubernetes: AI-powered cloud detection and response, and cloud security posture management findings triage.
Incident responseAll-In-One ToolsApache-2.0Release v1.14.0, Oct 13, 2026223 stars
Active last commit yesterday
Commits in 18 of the last 52 weeks
-
Falco
Cloud Native Runtime Security
Cloud securityContinuous Security AuditingApache-2.0Release 0.45.1, Oct 19, 20269.5K stars
- Latest release has downloads without a signature or checksum file
Active last commit yesterday
Commits in 50 of the last 52 weeks
-
Fibratus
Security sensor for realtime threat detection and protection
Incident responseWindows Evidence CollectionLicense: otherRelease v3.1.1, Aug 19, 20262.6K stars
- Latest release has a checksum file but no signature
Active last commit yesterday
Commits in 36 of the last 52 weeks
-
hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
Digital forensicsInternet ArtifactsApache-2.0Release v2026.06, Jul 8, 20261.5K stars
- Latest release has downloads without a signature or checksum file
Active last commit yesterday
Commits in 33 of the last 52 weeks
-
IOC Fanger (and Defanger)
Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .
Threat intelligenceToolsMIT68 stars
- Listed as ioc-fang/ioc_fanger, since renamed or moved
- No published releases
Active last commit yesterday
Commits in 23 of the last 52 weeks
-
IOC Finder
Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/
Threat intelligenceToolsLGPL-3.0184 stars
- No published releases
Active last commit yesterday
Commits in 32 of the last 52 weeks
-
Netcap
A framework for secure and scalable network traffic analysis - https://netcap.io
Network monitoringNetwork MonitoringGPL-3.0Release v0.13.0, Oct 9, 20261.8K stars
- Latest release has a checksum file but no signature
Active last commit yesterday
Commits in 24 of the last 52 weeks
-
OSSEC
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
Detection engineeringEndpoint MonitoringGPL-2.0Release 4.4.1, Oct 18, 20265.1K stars
Active last commit yesterday
Commits in 23 of the last 52 weeks
-
passivedns
A network sniffer that logs all DNS server replies for use in a passive DNS setup
Network monitoringMonitoring / LoggingLicense: other1.7K stars
- No published releases
Active last commit yesterday
Commits in 2 of the last 52 weeks
-
Plaso
Super timeline all the things
Incident responseTimeline ToolsApache-2.0Release 20260720, Jul 20, 20262.2K stars
Active last commit yesterday
Commits in 28 of the last 52 weeks
-
theHarvester
E-mails, subdomains and names Harvester - OSINT
Penetration testingPassive Information GatheringGPL-2.0Release 4.11.1, Jun 3, 202618K stars
Active last commit yesterday
Commits in 50 of the last 52 weeks
-
APKTool
A tool for reverse engineering Android apk files
Penetration testingMobile Penetration TestingApache-2.0Release v3.0.3, Jul 20, 202626.2K stars
- Latest release has downloads without a signature or checksum file
Active last commit 2 days ago
Commits in 39 of the last 52 weeks
-
macOS Artifact Parsing Tool (macapt)
macOS (& ios) Artifact Parsing Tool
Incident responseOSX Evidence CollectionMITRelease v.1.36.2, Oct 10, 20261.1K stars
- Latest release has downloads without a signature or checksum file
Active last commit 2 days ago
Commits in 21 of the last 52 weeks
-
Velociraptor
Digging Deeper....
Incident responseAll-In-One ToolsLicense: otherRelease v0.77.3, Oct 5, 20264.4K stars
Active last commit 2 days ago
Commits in 49 of the last 52 weeks
-
ALEX
Extract files from ADB devices on Windows, Linux and MacOS. Mostly a wrapper for adbutils.
Digital forensicsAcquisitionGPL-3.0Release v0.7, Oct 16, 2026116 stars
- Latest release has downloads without a signature or checksum file
Active last commit 3 days ago
Commits in 34 of the last 52 weeks
-
capa
The FLARE team's open-source tool to identify capabilities in executable files.
Malware analysisDetection and ClassificationApache-2.0Release v10.0.0, Oct 16, 20266.3K stars
- Listed as fireeye/capa, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 3 days ago
Commits in 45 of the last 52 weeks
-
Chronicle (GCP) Detection Rules
Collection of example YARA-L rules for use within Google Security Operations
Detection engineeringDetection Content & SignaturesApache-2.0Release content-manager-v1.0.7, Nov 12, 2025522 stars
Active last commit 3 days ago
Commits in 6 of the last 52 weeks
-
Magisk
The Magic Mask for Android
Penetration testingMobile Penetration TestingGPL-3.0Release v30.7, Feb 23, 202663.4K stars
- Latest release has downloads without a signature or checksum file
Active last commit 3 days ago
Commits in 44 of the last 52 weeks
-
Quark-Engine
Malware analysisDetection and ClassificationGPL-3.0Release v26.10.1, Oct 10, 20261.7K stars
- Listed as quark-engine/quark-engine, since renamed or moved
Active last commit 3 days ago
Commits in 49 of the last 52 weeks
-
Substation
Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
Detection engineeringDetection, Alerting and Automation PlatformsMITRelease v2.9.0, Oct 16, 2026407 stars
Active last commit 3 days ago
Commits in 3 of the last 52 weeks
-
turbinia
Automation and Scaling of Digital Forensics Tools
Digital forensicsFrameworksApache-2.0Release 20250131, Feb 5, 2025795 stars
Active last commit 3 days ago
Commits in 13 of the last 52 weeks
-
Zentral
Zentral is a control plane for secure, observable Apple endpoints in enterprises. Configure, observe, and enforce the desired state of every Apple endpoint. Manage that desired state as code through GitOps and Terraform.
Incident responseAll-In-One ToolsLicense: otherRelease v2026.5, Aug 21, 2026887 stars
Active last commit 3 days ago
Commits in 49 of the last 52 weeks
-
IPED - Indexador e Processador de Evidências Digitais
IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Digital forensicsFrameworksLicense: otherRelease 4.3.1, Mar 29, 20263.1K stars
- Latest release has downloads without a signature or checksum file
Active last commit 4 days ago
Commits in 46 of the last 52 weeks
-
MISP Workbench
Built for the frontlines of cyber defense, our next-generation MISP empowers edge deployments and threat hunters with fast, lightweight, and actionable intelligence, anytime, anywhere.
Threat intelligenceToolsAGPL-3.0Release beta-1.6, Jul 9, 202635 stars
Active last commit 4 days ago
Commits in 39 of the last 52 weeks
-
MSTIC Jupyter and Python Security Tools
Microsoft Threat Intelligence Security Tools
Threat intelligenceToolsLicense: otherRelease v3.1.0, Sep 21, 20262K stars
Active last commit 4 days ago
Commits in 27 of the last 52 weeks
-
osquery
SQL powered operating system instrumentation, monitoring, and analytics.
Digital forensicsLive ForensicsLicense: otherRelease 5.23.1, Jun 24, 202623.7K stars
- Latest release has downloads without a signature or checksum file
Active last commit 4 days ago
Commits in 38 of the last 52 weeks
-
unfurl
Extract and Visualize Data from URLs using Unfurl
Digital forensicsInternet ArtifactsApache-2.0Release v2026.10, Oct 7, 2026776 stars
Active last commit 4 days ago
Commits in 14 of the last 52 weeks
-
yara
The pattern matching swiss knife
Malware analysisIOC and Pattern IdentificationBSD-3-ClauseRelease v4.5.8, Jul 28, 202610K stars
Active last commit 4 days ago
Commits in 16 of the last 52 weeks
-
Chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
Incident responseLog Analysis ToolsGPL-3.0Release v2.17.1, Oct 14, 20263.7K stars
- Listed as countercept/chainsaw, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 5 days ago
Commits in 16 of the last 52 weeks
-
JADX
Dex to Java decompiler
Reverse engineeringJava DecompilersApache-2.0Release v1.5.6, Jul 10, 202651.1K stars
- Latest release has downloads without a signature or checksum file
Active last commit 5 days ago
Commits in 45 of the last 52 weeks
-
pe-bear
Portable Executable reversing tool with a friendly GUI
Malware analysisInspectorGPL-2.0Release v0.7.2, Jun 5, 20263.9K stars
- Latest release has downloads without a signature or checksum file
Active last commit 5 days ago
Commits in 6 of the last 52 weeks
-
The Sleuth Kit
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
Digital forensicsFrameworksRelease sleuthkit-4.15.0, Apr 15, 20263.2K stars
- No license file
Active last commit 5 days ago
Commits in 33 of the last 52 weeks
-
Timesketch
Collaborative forensic timeline analysis
Incident responseTimeline ToolsApache-2.0Release 20261014, Oct 14, 20263.4K stars
Active last commit 5 days ago
Commits in 41 of the last 52 weeks
-
Cortex
Cortex: a Powerful Observable Analysis and Active Response Engine
Threat intelligenceFrameworks and PlatformsAGPL-3.0Release 4.1.0, Jun 30, 20261.6K stars
Active last commit 6 days ago
Commits in 9 of the last 52 weeks
-
sysmon-modular
A repository of sysmon configuration modules
Detection engineeringConfigurationMITRelease configs-a45dedb13a43, Oct 14, 20263.2K stars
- Latest release has a checksum file but no signature
Active last commit 6 days ago
Commits in 10 of the last 52 weeks
-
AndroGuard
Reverse engineering and pentesting for Android applications
Penetration testingMobile Penetration TestingApache-2.0Release v4.1.4, Jun 5, 20266.4K stars
- Latest release has downloads without a signature or checksum file
Active last commit 7 days ago
Commits in 5 of the last 52 weeks
-
Hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Incident responseLog Analysis ToolsAGPL-3.0Release v4.2.0, Oct 13, 20263.4K stars
- Latest release has downloads without a signature or checksum file
Active last commit 7 days ago
Commits in 28 of the last 52 weeks
-
KapeFiles
This repository serves as a place for community created Targets and Modules for use with KAPE.
Malware analysisFile IdentificationMIT888 stars
- No published releases
Active last commit 7 days ago
Commits in 22 of the last 52 weeks
-
KQL Advanced Hunting Queries & Analytics Rules
Bert-JanP/Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Detection engineeringDetection Content & SignaturesBSD-3-Clause1.8K stars
- No published releases
Active last commit 7 days ago
Commits in 26 of the last 52 weeks
-
MobSF
MobSF/Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Penetration testingMobile Penetration TestingGPL-3.0Release v4.5.3, Sep 21, 202622K stars
Active last commit 7 days ago
Commits in 10 of the last 52 weeks
-
PortEx
Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
Malware analysisDetection and ClassificationApache-2.0Release v5.0.7, Oct 11, 2026543 stars
- Listed as katjahahn/PortEx, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 7 days ago
Commits in 4 of the last 52 weeks
-
Volatility 3
volatilityfoundation/volatility3
Volatility 3.0 development
Incident responseMemory Analysis ToolsLicense: otherRelease v2.28.2, Sep 17, 20264.5K stars
- Latest release has downloads without a signature or checksum file
Active last commit 7 days ago
Commits in 30 of the last 52 weeks
-
Bulk Extractor
This is the development tree. Production downloads are at:
Digital forensicsDigital ForensicsLicense: otherRelease v2.2.0, Aug 18, 20261.4K stars
- Latest release has a checksum file but no signature
Active last commit 8 days ago
Commits in 11 of the last 52 weeks
-
Recog
Pattern recognition for hosts, services, and content
Network monitoringFingerprinting ToolsLicense: otherRelease v3.3.2, Oct 12, 2026795 stars
- Latest release has downloads without a signature or checksum file
Active last commit 8 days ago
Commits in 15 of the last 52 weeks
-
Sigma2KQL
Sigma Queries turned into KQL for Defender using pysigma - Automated
Detection engineeringDetection Content & SignaturesRelease 2025_11_2_Sigma2KQL, Nov 15, 20255 stars
- Fork of another repository
- No license file
Active last commit 8 days ago
Commits in 31 of the last 52 weeks
-
Sigma2SPL
Sigma Queries turned into SPL for Splunk Enterprise and Enterprise Security using pysigma - Automated
Network monitoringMonitoring / Logging1 stars
- No license file
- No published releases
Active last commit 8 days ago
Commits in 33 of the last 52 weeks
-
TerraSigma
TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel
Detection engineeringDetection Content & SignaturesRelease 2025_11_2_TerraSigma, Nov 17, 20255 stars
- No license file
Active last commit 8 days ago
Commits in 27 of the last 52 weeks
-
Amele
Unified digital forensics platform bringing disk, RAM, container drift, logical acquisition, and backup analysis together for Windows, Linux, Docker, Android, and iOS.
Digital forensicsAcquisitionLicense: otherRelease v0.1.1, Oct 8, 202628 stars
- Latest release has downloads without a signature or checksum file
Active last commit 9 days ago
Commits in 22 of the last 52 weeks
-
FernFlower
Decompiler from Java bytecode to Java, used in IntelliJ IDEA.
Reverse engineeringJava DecompilersApache-2.04.4K stars
- Listed as fesh0r/fernflower, since renamed or moved
- No published releases
Active last commit 10 days ago
Commits in 23 of the last 52 weeks
-
panther-labs
Built-in Panther detection rules and policies
Cloud securityDigital Forensics and Incident ResponseApache-2.0Release v3.114.0, Aug 27, 2026471 stars
Active last commit 10 days ago
Commits in 41 of the last 52 weeks
-
dnsrecon
DNS Enumeration Script
Penetration testingActive Information GatheringGPL-2.0Release 1.6.3, Jun 28, 20263.1K stars
Active last commit 11 days ago
Commits in 38 of the last 52 weeks
-
Dissect
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
Incident responseAll-In-One ToolsAGPL-3.0Release 3.22, Feb 26, 20261.2K stars
Active last commit 12 days ago
Commits in 4 of the last 52 weeks
-
Flare
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Incident responseAll-In-One ToolsApache-2.0Release vbox-1.0.0, Aug 13, 20259.2K stars
- Listed as fireeye/flare-vm, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 12 days ago
Commits in 7 of the last 52 weeks
-
MemProcFS
MemProcFS
Digital forensicsMemory ForensicsAGPL-3.0Release v5.19, Oct 5, 20264.4K stars
- Latest release has downloads without a signature or checksum file
Active last commit 14 days ago
Commits in 26 of the last 52 weeks
-
Recon-ng
Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.
Penetration testingPenetration TestingGPL-3.06K stars
- No published releases
Active last commit 14 days ago
Commits in 1 of the last 52 weeks
-
uncompyle6
A cross-version Python bytecode decompiler
Malware analysisDeobfuscationGPL-3.0Release 3.9.3, Sep 29, 20254.3K stars
- Latest release has downloads without a signature or checksum file
Active last commit 14 days ago
Commits in 9 of the last 52 weeks
-
GRR Rapid Response
GRR Rapid Response: remote live forensics for incident response
Incident responseAll-In-One ToolsApache-2.0Release v.4.0.0.0-release, Dec 15, 20255.1K stars
Active last commit 18 days ago
Commits in 7 of the last 52 weeks
-
WELA
WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.
Incident responseLog Analysis ToolsMITRelease v2.1.0, Feb 13, 2026125 stars
Active last commit 18 days ago
Commits in 37 of the last 52 weeks
-
Darkmoon
Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.
Penetration testingPenetration TestingGPL-3.0Release v1.5.0, Sep 25, 20261.1K stars
Active last commit 19 days ago
Commits in 41 of the last 52 weeks
-
DFTimewolf
A framework for orchestrating forensic collection, processing and data export
Incident responseIncident ManagementApache-2.0360 stars
- No published releases
Active last commit 19 days ago
Commits in 33 of the last 52 weeks
-
Shuffle
Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
Incident responseIncident ManagementAGPL-3.0Release v2.3.0, Sep 28, 20262.5K stars
- Listed as frikky/Shuffle, since renamed or moved
Active last commit 21 days ago
Commits in 45 of the last 52 weeks
-
Shuffle
Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
Detection engineeringDetection, Alerting and Automation PlatformsAGPL-3.0Release v2.3.0, Sep 28, 20262.5K stars
Active last commit 21 days ago
Commits in 45 of the last 52 weeks
-
Forensic Artifacts
Digital Forensics artifact repository
Incident responseEvidence CollectionApache-2.0Release 20260127, Jan 27, 20261.3K stars
Active last commit 23 days ago
Commits in 15 of the last 52 weeks
-
Krakatau
Java decompiler, assembler, and disassembler
Reverse engineeringJava DecompilersGPL-3.02.3K stars
- No published releases
Active last commit 25 days ago
Commits in 3 of the last 52 weeks
-
IRIS
Collaborative Incident Response platform
Incident responseAll-In-One ToolsLGPL-3.0Release v2.4.29, Aug 10, 20261.6K stars
Active last commit 26 days ago
Commits in 31 of the last 52 weeks
-
Mercury
Mercury: network metadata capture and analysis
Network monitoringFingerprinting ToolsLicense: other520 stars
- No published releases
Active last commit 26 days ago
Commits in 47 of the last 52 weeks
-
APT Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
Incident responseLog Analysis ToolsGPL-3.0Release V4.0, Sep 20, 20261.4K stars
- Latest release has downloads without a signature or checksum file
Active last commit 30 days ago
Commits in 1 of the last 52 weeks
-
Exabeam Common Information Model
CIM Library
Detection engineeringLogging, Monitoring & Data SourcesApache-2.012 stars
- No published releases
Active last commit 33 days ago
Commits in 8 of the last 52 weeks
-
Sysmon for Linux
Sysmon for Linux
Detection engineeringEndpoint MonitoringMITRelease 1.5.3, Sep 10, 20262.2K stars
- Listed as Sysinternals/SysmonForLinux, since renamed or moved
- Latest release has downloads without a signature or checksum file
Active last commit 35 days ago
Commits in 10 of the last 52 weeks
-
Fast Incident Response (FIR)
Fast Incident Response
Incident responseIncident ManagementGPL-3.0Release django4, Sep 13, 20222K stars
Active last commit 36 days ago
Commits in 23 of the last 52 weeks
-
MFTExtractor
File system forensics
Digital forensicsNTFS/MFT ProcessingLicense: otherRelease 0.5.6, Jul 16, 202618 stars
- Latest release has downloads without a signature or checksum file
Active last commit 36 days ago
Commits in 25 of the last 52 weeks
-
Orochi
The Volatility Collaborative GUI
Incident responseMemory Analysis ToolsMITRelease v.2.5.0, Sep 10, 2026278 stars
Active last commit 39 days ago
Commits in 3 of the last 52 weeks
-
UAC
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
Incident responseEvidence CollectionApache-2.0Release v3.4.0, Sep 9, 20261.5K stars
- Latest release has a checksum file but no signature
Active last commit 40 days ago
Commits in 27 of the last 52 weeks
-
go-audit
go-audit is an alternative to the auditd daemon that ships with many distros
Detection engineeringEndpoint MonitoringMITRelease v1.2.2, Jun 22, 20261.7K stars
Active last commit 41 days ago
Commits in 10 of the last 52 weeks
-
IntelOwl
IntelOwl: manage your Threat Intelligence at scale
Threat intelligenceFrameworks and PlatformsAGPL-3.0Release v6.8.0, Aug 31, 20264.8K stars
Active last commit 48 days ago
Commits in 38 of the last 52 weeks
-
Manalyze
A static analyzer for PE executables.
Malware analysisDetection and ClassificationGPL-3.0Release v1.0.0, Jul 21, 20261.1K stars
- Latest release has downloads without a signature or checksum file
Active last commit 52 days ago
Commits in 7 of the last 52 weeks
-
Blauhaunt
A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts
Digital forensicsWindows ArtifactsMIT186 stars
- No published releases
Active last commit 62 days ago
Commits in 6 of the last 52 weeks
-
GQUIC Protocol Analyzer for Zeek
salesforce/GQUIC_Protocol_Analyzer
GQUIC Protocol Analyzer for Zeek (Bro) Network Security Monitor
Network monitoringFingerprinting ToolsLicense: other83 stars
- No published releases
Active last commit 67 days ago
Commits in 2 of the last 52 weeks
-
Active last commit 67 days ago
Commits in 2 of the last 52 weeks
-
Acquire
acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.
Incident responseEvidence CollectionAGPL-3.0Release 3.22, Feb 26, 2026121 stars
Active last commit 68 days ago
Commits in 12 of the last 52 weeks
-
SOCTalk
AI-powered multi-tenant SOC automation agent using LangGraph with Wazuh, Cortex, TheHive & MISP integration
Detection engineeringLogging, Monitoring & Data SourcesApache-2.0Release v0.2.1, Aug 12, 202690 stars
- Latest release has a checksum file but no signature
Active last commit 69 days ago
Commits in 18 of the last 52 weeks
-
fn2yara
Automated static analysis tools for binary programs
Malware analysisDetection and ClassificationLicense: other1.7K stars
- No published releases
Active last commit 77 days ago
Commits in 14 of the last 52 weeks
-
LogonTracer
Investigate malicious Windows logon by visualizing and analyzing Windows event log
Incident responseLog Analysis ToolsLicense: otherRelease v2.0.0, Apr 22, 20263.3K stars
Active last commit 79 days ago
Commits in 2 of the last 52 weeks
-
VanGuard
ridgelinecyberdefence/vanguard
Cross-platform incident response toolkit. 28 pre-built use cases in a single zero-install binary: triage, threat hunting, memory forensics, disk collection, remote operations, and Velociraptor management. Works air-gapped, with automated timeline generation.
Incident responseAll-In-One ToolsMITRelease v1.0.1, Jul 6, 2026158 stars
- Latest release has a checksum file but no signature
Active last commit 83 days ago
Commits in 3 of the last 52 weeks
-
Ridgeline Detection Library
ridgelinecyberdefence/Enterprise-Detection-Engineering
Production-validated detection queries and hunting artifacts across 9 platforms (KQL, Sigma, Splunk, Athena, PowerShell, Velociraptor, YARA, Suricata, osquery). Each with triggers, false positives, tuning guidance, and validation steps.
Detection engineeringDetection Content & SignaturesApache-2.011 stars
- No published releases
Active last commit 84 days ago
Commits in 3 of the last 52 weeks
-
opensnitch
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
Network monitoringMonitoring / LoggingGPL-3.0Release v1.8.0, Dec 15, 202514.2K stars
Active last commit 85 days ago
Commits in 28 of the last 52 weeks
-
RecuperaBit
A tool for forensic file system reconstruction.
Digital forensicsNTFS/MFT ProcessingGPL-3.0Release v1.1.6, Jan 2, 2022625 stars
Active last commit 85 days ago
Commits in 4 of the last 52 weeks
-
Catalyst
⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes
Incident responseIncident ManagementAGPL-3.0Release v0.15.7, Jan 11, 2026537 stars
- Latest release has a checksum file but no signature
Archived archived by the owner, last commit 94 days ago
Commits in 12 of the last 52 weeks
-
Detection Engineering with Splunk
west-wind/Threat-Hunting-With-Splunk
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
Detection engineeringDetection Content & SignaturesMIT69 stars
- No published releases
Slowing last commit 109 days ago
Commits in 3 of the last 52 weeks
-
PyInstaller Extractor
extremecoders-re/pyinstxtractor
PyInstaller Extractor
Malware analysisDeobfuscationGPL-3.0Release 2026.07, Jul 22, 20264.5K stars
Slowing last commit 109 days ago
Commits in 2 of the last 52 weeks
-
NTFSTool
Forensics tool for NTFS (parser, mft, bitlocker, deleted files)
Digital forensicsNTFS/MFT ProcessingMITRelease v1.7, Jul 23, 2023630 stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 115 days ago
Commits in 2 of the last 52 weeks
-
unixcollector
unix_collector is a Live Response collection script for Incident Response on UNIX-like systems using native binaries. Supports AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
Digital forensicsAcquisitionGPL-3.0Release 2.0, Jun 10, 202544 stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 123 days ago
Commits in 1 of the last 52 weeks
-
AIFT
AIFT is a GUI, CLI, REST API, and MCP tool that helps DFIR analysts get oriented quickly. Point it at disk images, VM images, forensic archives, or triage packages; AIFT discovers what can be opened, parses artifacts with Dissect, and uses AI to turn parsed data into concrete leads and gaps for the investigator to verify.
Digital forensicsFrameworksAGPL-3.0Release v2.0, Jun 13, 202651 stars
Slowing last commit 128 days ago
Commits in 12 of the last 52 weeks
-
n6
Automated handling of data feeds for security teams
Threat intelligenceFrameworks and PlatformsAGPL-3.0Release v4.42.0, Jun 3, 2026149 stars
Slowing last commit 137 days ago
Commits in 3 of the last 52 weeks
-
Machinae
Machinae Security Intelligence Collector
Threat intelligenceToolsMITRelease 1.4.8, May 9, 2019536 stars
Slowing last commit 138 days ago
Commits in 1 of the last 52 weeks
-
Fuji
macOS forensic acquisition made simple
Digital forensicsAcquisitionGPL-3.0Release 1.2.0, Feb 14, 2026311 stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 139 days ago
Commits in 7 of the last 52 weeks
-
Fakenet-NG
FakeNet-NG - Next Generation Dynamic Network Analysis Tool
Malware analysisDynamic Analysis ToolsApache-2.0Release v3.5, Apr 9, 20252.2K stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 144 days ago
Commits in 4 of the last 52 weeks
-
RegRipper
RegRipper3.0
Incident responseWindows Evidence CollectionLicense: other724 stars
- No published releases
Slowing last commit 145 days ago
Commits in 3 of the last 52 weeks
-
ThreatIngestor
Extract and aggregate threat intelligence.
Threat intelligenceToolsGPL-2.0Release v1.4.0, Nov 2, 2023932 stars
- Listed as InQuest/ThreatIngestor, since renamed or moved
Slowing last commit 146 days ago
Commits in 1 of the last 52 weeks
-
RegRippy
A modern Python-3-based alternative to RegRipper
Digital forensicsWindows ArtifactsApache-2.0220 stars
- No published releases
Slowing last commit 160 days ago
Commits in 1 of the last 52 weeks
-
threatintel
Threat Intelligence APIs
Threat intelligenceToolsMITRelease v0.2.0, Apr 23, 2020286 stars
Slowing last commit 167 days ago
Commits in 2 of the last 52 weeks
-
auditd configuration
Best Practice Auditd Configuration
Detection engineeringConfigurationApache-2.0Release v0.2.0, Apr 21, 20262K stars
Slowing last commit 168 days ago
Commits in 5 of the last 52 weeks
-
IntelMQ
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
Digital forensicsFrameworksAGPL-3.0Release 3.5.0, Nov 1, 20251.1K stars
Slowing last commit 178 days ago
Commits in 9 of the last 52 weeks
-
wafw00f
WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.
Penetration testingActive Information GatheringBSD-3-ClauseRelease v2.4.2, Jan 26, 20266.6K stars
Slowing last commit 183 days ago
Commits in 6 of the last 52 weeks
-
autosecure
Threat-feed IP block automation for Linux and macOS firewalls (iptables, nftables, pf) with cron-ready updates, dry-run previews, and package releases.
Malware analysisThreat IntelligenceGPL-3.0Release v2.3.4, Apr 16, 202617 stars
Slowing last commit 186 days ago
Commits in 4 of the last 52 weeks
-
NullSec LogReaper
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
Incident responseLog Analysis ToolsMITRelease v1.1.0, Mar 21, 202683 stars
Slowing last commit 187 days ago
Commits in 4 of the last 52 weeks
-
Sysdig
Linux system exploration and troubleshooting tool with first class support for containers
Detection engineeringEndpoint MonitoringLicense: otherRelease 0.41.4, Jan 29, 20268.3K stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 189 days ago
Commits in 7 of the last 52 weeks
-
Hypoxia
Zero-dependency Python CLI for targeted file collection - digital forensics, incident response, and selective backups. Cross-platform, with SHA-256 manifests, chain-of-custody logging, and checkpoint/resume for failing media.
Digital forensicsAcquisitionGPL-3.0Release 1.3.0, Apr 9, 20264 stars
- Latest release has a checksum file but no signature
Slowing last commit 193 days ago
Commits in 4 of the last 52 weeks
-
Drozer
The Leading Security Assessment Framework for Android.
Penetration testingMobile Penetration TestingLicense: otherRelease 3.1.0, Aug 1, 20244.6K stars
- Listed as mwrlabs/drozer, since renamed or moved
- Latest release has downloads without a signature or checksum file
Slowing last commit 195 days ago
Commits in 3 of the last 52 weeks
-
LiME
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory capt
Incident responseMemory Analysis ToolsGPL-2.0Release v1.12.0, Mar 31, 20262.1K stars
- Listed as 504ensicsLabs/LiME, since renamed or moved
Slowing last commit 197 days ago
Commits in 5 of the last 52 weeks
-
LiME
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory capt
Digital forensicsAcquisitionGPL-2.0Release v1.12.0, Mar 31, 20262.1K stars
Slowing last commit 197 days ago
Commits in 5 of the last 52 weeks
-
WhatWeb
Next generation web scanner
Penetration testingPassive Information GatheringGPL-2.0Release v0.6.4, Apr 2, 20266.9K stars
Slowing last commit 200 days ago
Commits in 1 of the last 52 weeks
-
Anvilogic Detection Armory
Anvilogic Forge
Detection engineeringDetection Content & SignaturesGPL-3.0119 stars
- No published releases
Slowing last commit 202 days ago
Commits in 1 of the last 52 weeks
-
POFR
Penguin OS Forensic (or Flight) Recorder
Digital forensicsLive ForensicsGPL-2.0Release v1.4.0, Mar 27, 202641 stars
Slowing last commit 206 days ago
Commits in 2 of the last 52 weeks
-
tcpflow
TCP/IP packet demultiplexer. Download from:
Network monitoringFull Packet Capture / ForensicGPL-3.0Release tcpflow-1.6.1, Feb 19, 20211.8K stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 263 days ago
Commits in 1 of the last 52 weeks
-
ole-tools
oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
Malware analysisMicrosoft OfficeLicense: otherRelease v0.60.2, Jul 2, 20243.4K stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 266 days ago
Commits in 1 of the last 52 weeks
-
AWS Security Automation
awslabs/aws-security-automation
Collection of scripts and resources for DevSecOps and Automated Incident Response Security
Cloud securityDigital Forensics and Incident Response632 stars
- No license file
- No published releases
Archived archived by the owner, last commit 278 days ago
Commits in 1 of the last 52 weeks
-
DFIRTrack
DFIRTrack - The Incident Response Tracking Application
Incident responseIncident ManagementLicense: other540 stars
- No published releases
Slowing last commit 279 days ago
Commits in 2 of the last 52 weeks
-
RITA
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
Threat intelligenceToolsGPL-3.0Release v4.8.2, Jan 12, 20262.5K stars
- Listed as ocmdev/rita, since renamed or moved
- Latest release has downloads without a signature or checksum file
Slowing last commit 280 days ago
Commits in 2 of the last 52 weeks
-
Yara rules generator
yarGen is a generator for YARA rules
Malware analysisDetection and ClassificationLicense: otherRelease 0.23.4, Dec 29, 20201.8K stars
Slowing last commit 282 days ago
Commits in 1 of the last 52 weeks
-
Loki
Loki - Simple IOC and YARA Scanner
Malware analysisIOC and Pattern IdentificationGPL-3.0Release v0.51.0, May 18, 20233.8K stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 283 days ago
Commits in 1 of the last 52 weeks
-
TypeDB CTI
Open Source Threat Intelligence Platform
Threat intelligenceFrameworks and Platforms170 stars
- No license file
- No published releases
Slowing last commit 284 days ago
Commits in 2 of the last 52 weeks
-
OpenTAXII
TAXII server implementation in Python from EclecticIQ
Threat intelligenceFrameworks and PlatformsBSD-3-ClauseRelease 0.10.0b1, Jan 5, 2026217 stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 287 days ago
Commits in 5 of the last 52 weeks
-
ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
Detection engineeringDetection RulesMIT4.7K stars
- No published releases
Slowing last commit 294 days ago
Commits in 0 of the last 52 weeks
-
FIT
FIT is a modular suite of Python applications for digital forensic acquisition of online contents such as web pages, emails, social media, and more. Each module can run independently or as part of the full FIT suite.
Digital forensicsAcquisitionGPL-3.0Release v2.2.0, Mar 16, 2025106 stars
- Latest release has downloads without a signature or checksum file
Slowing last commit 357 days ago
Commits in 1 of the last 52 weeks
-
ElectricEye
ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations to harden your CSP & SaaS environments with controls mapped to over 20 industry, regulatory, and best practice controls frameworks
Cloud securityContinuous Security AuditingApache-2.01K stars
- No published releases
Inactive last commit 412 days ago
Commits in 0 of the last 52 weeks
-
BoxyHQ
🔥 A fully open source audit logs service and embeddable UI easily deployed to your own Kubernetes cluster. Brought to you by replicated.com and boxyhq.com 🚀
Network monitoringMonitoring / LoggingApache-2.0Release v1.13.1, Nov 6, 2024451 stars
Inactive last commit 419 days ago
Commits in 0 of the last 52 weeks
-
un{i}packer
Automatic and platform-independent unpacker for Windows binaries based on emulation
Malware analysisDeobfuscationGPL-2.0Release 1.0.8, May 21, 2024783 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 427 days ago
Commits in 0 of the last 52 weeks
-
Stixview
STIX2 graph visualisation library in JS
Threat intelligenceToolsBSD-3-ClauseRelease v2.2.0, Jul 14, 2024102 stars
Inactive last commit 485 days ago
Commits in 0 of the last 52 weeks
-
Loghub
A large collection of system log datasets for AI-driven log analytics [ISSRE'23]
Detection engineeringLogging, Monitoring & Data SourcesLicense: other2.9K stars
- No published releases
Inactive last commit 493 days ago
Commits in 0 of the last 52 weeks
-
xortool
A tool to analyze multi-byte xor cipher
Malware analysisDeobfuscation1.5K stars
- No license file
- No published releases
Inactive last commit 516 days ago
Commits in 0 of the last 52 weeks
-
Volatility
volatilityfoundation/volatility
An advanced memory forensics framework
Incident responseMemory Analysis ToolsGPL-2.0Release 2.6.1, Apr 9, 20248.1K stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 521 days ago
Commits in 0 of the last 52 weeks
-
SOC Multi-tool
A powerful and user-friendly browser extension that streamlines investigations for security professionals.
Incident responseAll-In-One ToolsMIT422 stars
- No published releases
Inactive last commit 524 days ago
Commits in 0 of the last 52 weeks
-
artifactcollector
forensicanalysis/artifactcollector
🧭 The artifactcollector is a customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
Incident responseEvidence CollectionMITRelease v0.17.1, Oct 19, 2024308 stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 530 days ago
Commits in 0 of the last 52 weeks
-
HASSH
HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of a small MD5 fingerprint.
Network monitoringFingerprinting ToolsBSD-3-Clause554 stars
- No published releases
Archived archived by the owner, last commit 536 days ago
Commits in 0 of the last 52 weeks
-
JA3
JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.
Network monitoringFingerprinting ToolsBSD-3-Clause3.1K stars
- No published releases
Archived archived by the owner, last commit 536 days ago
Commits in 0 of the last 52 weeks
-
ForensicMiner
A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
Digital forensicsAcquisitionMITRelease v1.4, Dec 30, 2023164 stars
Inactive last commit 561 days ago
Commits in 0 of the last 52 weeks
-
Matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
Incident responseAll-In-One ToolsApache-2.01.7K stars
- No published releases
Inactive last commit 650 days ago
Commits in 0 of the last 52 weeks
-
AIOCRIOC
An LLM and OCR based Indicator of Compromise Extraction Tool
Threat intelligenceToolsApache-2.038 stars
- No published releases
Inactive last commit 684 days ago
Commits in 0 of the last 52 weeks
-
MEERKAT
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
Incident responseWindows Evidence CollectionGPL-3.0483 stars
- No published releases
Inactive last commit 703 days ago
Commits in 0 of the last 52 weeks
-
Sandia Cyber Omni Tracker (SCOT)
Sandia Cyber Omni Tracker (SCOT)
Incident responseIncident ManagementLicense: otherRelease v3.20.0, Aug 15, 2022254 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 714 days ago
Commits in 0 of the last 52 weeks
-
SPECTR3
Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.
Incident responseEvidence CollectionLGPL-3.0Release v0.7.7, Oct 25, 202444 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 725 days ago
Commits in 0 of the last 52 weeks
-
Kuiper
Digital Forensics Investigation Platform
Incident responseAll-In-One ToolsRelease v2.3.5, Nov 18, 2023909 stars
- No license file
Inactive last commit 738 days ago
Commits in 0 of the last 52 weeks
-
zipdump
Analyze zipfile, either local, or from url
Malware analysisIOC and Pattern IdentificationMIT39 stars
- No published releases
Inactive last commit 746 days ago
Commits in 0 of the last 52 weeks
-
iocextract
Defanged Indicator of Compromise (IOC) Extractor.
Threat intelligenceToolsGPL-2.0Release v1.16.1, Sep 22, 2023584 stars
- Listed as InQuest/python-iocextract, since renamed or moved
Inactive last commit 782 days ago
Commits in 0 of the last 52 weeks
-
Logdissect
CLI utility and Python module for analyzing log files and other data.
Incident responseLog Analysis ToolsMITRelease v3.1.1, Apr 7, 2018161 stars
Inactive last commit 803 days ago
Commits in 0 of the last 52 weeks
-
timeliner
A rewrite of mactime, a bodyfile reader
Digital forensicsTimeline AnalysisApache-2.041 stars
- No published releases
Inactive last commit 805 days ago
Commits in 0 of the last 52 weeks
-
Wombat Forensics
linux c++, fox-toolkit, multi-threaded forensic gui tool
Digital forensicsFrameworksGPL-2.048 stars
- No published releases
Inactive last commit 822 days ago
Commits in 0 of the last 52 weeks
-
Google Cloud Security Analytics
GoogleCloudPlatform/security-analytics
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
Detection engineeringDetection Content & SignaturesApache-2.0370 stars
- No published releases
Archived archived by the owner, last commit 859 days ago
Commits in 0 of the last 52 weeks
-
Dshell
Dshell is a network forensic analysis framework.
Network monitoringFull Packet Capture / ForensicLicense: otherRelease v3.2.3, May 7, 20245.5K stars
Inactive last commit 901 days ago
Commits in 0 of the last 52 weeks
-
ViperMonkey
A VBA parser and emulation engine to analyze malicious macros.
Malware analysisMicrosoft Office1.1K stars
- No license file
- No published releases
Inactive last commit 907 days ago
Commits in 0 of the last 52 weeks
-
DataCop
Protect your data in AWS S3 with DataCop!
Cloud securityDigital Forensics and Incident ResponseApache-2.014 stars
- No published releases
Inactive last commit 910 days ago
Commits in 0 of the last 52 weeks
-
Center for Threat Informed Defense Security Stack Mappings
center-for-threat-informed-defense/security-stack-mappings
🚨ATTENTION🚨 The Security Stack Mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
Detection engineeringDetection Content & SignaturesApache-2.0Release v1.1.0, Sep 21, 2021388 stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 929 days ago
Commits in 0 of the last 52 weeks
-
Linux Expl0rer
Easy-to-use live forensics toolbox for Linux endpoints
Digital forensicsLive ForensicsApache-2.0404 stars
- No published releases
Archived archived by the owner, last commit 960 days ago
Commits in 0 of the last 52 weeks
-
aws-incident-response
easttimor/aws-incident-response
Cloud securityDigital Forensics and Incident ResponseMIT378 stars
- No published releases
Inactive last commit 969 days ago
Commits in 0 of the last 52 weeks
-
threatnote
DefensePointSecurity/threat_note
DPS' Lightweight Investigation Notebook
Incident responseIncident ManagementApache-2.0432 stars
- Listed as defpoint/threat_note, since renamed or moved
- No published releases
Archived archived by the owner, last commit 1023 days ago
Commits in 0 of the last 52 weeks
-
MalConfScan
Volatility plugin for extracts configuration data of known malware
Incident responseMemory Analysis ToolsLicense: otherRelease v1.0.5, Aug 31, 2021498 stars
Inactive last commit 1033 days ago
Commits in 0 of the last 52 weeks
-
SysmonSearch
Investigate suspicious activity by visualizing Sysmon's event log
Incident responseLog Analysis ToolsLicense: otherRelease v2.0, Apr 30, 2020432 stars
Inactive last commit 1033 days ago
Commits in 0 of the last 52 weeks
-
sysmon-DFIR
Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
Detection engineeringConfigurationGPL-3.0946 stars
- No published releases
Inactive last commit 1042 days ago
Commits in 0 of the last 52 weeks
-
MAGNET DumpIt
Memory acquisition for Linux that makes sense.
Incident responseLinux Evidence CollectionApache-2.0253 stars
- No published releases
Inactive last commit 1063 days ago
Commits in 0 of the last 52 weeks
-
Deepfence PacketStreamer
:star: :star: Distributed tcpdump for cloud native environments :star: :star:
Network monitoringFull Packet Capture / ForensicApache-2.0Release v0.1.0, Jun 23, 20221.9K stars
Archived archived by the owner, last commit 1096 days ago
Commits in 0 of the last 52 weeks
-
inVtero.net
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
Incident responseMemory Analysis ToolsAGPL-3.0Release CORE-0.1, Aug 28, 2017296 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 1116 days ago
Commits in 0 of the last 52 weeks
-
hashlookup-forensic-analyser
hashlookup/hashlookup-forensic-analyser
Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - https://circl.lu/services/hashlookup/
Digital forensicsFrameworksLicense: otherRelease v1.3, Sep 24, 2023131 stars
Inactive last commit 1121 days ago
Commits in 0 of the last 52 weeks
-
VirtualDeobfuscator
Reverse engineering tool for virtualization wrappers
Malware analysisDeobfuscation152 stars
- No license file
- No published releases
Inactive last commit 1138 days ago
Commits in 0 of the last 52 weeks
-
Billing Alerts CFN templates
Cloud securityContinuous Security AuditingMIT75 stars
- No published releases
Inactive last commit 1170 days ago
Commits in 0 of the last 52 weeks
-
Diffy
:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
Cloud securityDigital Forensics and Incident ResponseApache-2.0630 stars
- No published releases
Inactive last commit 1182 days ago
Commits in 0 of the last 52 weeks
-
python-evt
Pure Python parser for classic Windows Event Log files (.evt)
Digital forensicsWindows ArtifactsApache-2.052 stars
- No published releases
Inactive last commit 1207 days ago
Commits in 0 of the last 52 weeks
-
Hfinger
Hfinger - fingerprinting HTTP requests
Network monitoringFingerprinting ToolsGPL-3.0Release v0.2.2, May 16, 2023148 stars
Inactive last commit 1252 days ago
Commits in 0 of the last 52 weeks
-
GOSINT
The GOSINT framework is a project used for collecting, processing, and exporting high quality indicators of compromise (IOCs).
Threat intelligenceToolsBSD-3-Clause561 stars
- No published releases
Archived archived by the owner, last commit 1259 days ago
Commits in 0 of the last 52 weeks
-
Bearded Avenger
CIF v3 -- the fastest way to consume threat intelligence
Threat intelligenceFrameworks and PlatformsMPL-2.0Release 3.1.0, Mar 10, 2021189 stars
Archived archived by the owner, last commit 1278 days ago
Commits in 0 of the last 52 weeks
-
APFS Fuse
FUSE driver for APFS (Apple File System)
Digital forensicsOS X ForensicsGPL-2.02.2K stars
- No published releases
Inactive last commit 1317 days ago
Commits in 0 of the last 52 weeks
-
MutableSecurity
MutableSecurity/mutablesecurity
CLI program for automating the setup, configuration, and use of cybersecurity solutions
Incident responseAll-In-One ToolsMITRelease v0.4.0, Oct 22, 202250 stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 1345 days ago
Commits in 0 of the last 52 weeks
-
FireHOL IP Aggregator
spacepatcher/firehol-ip-aggregator
App for storing FireHOL feeds (https://github.com/firehol/blocklist-ipsets) with a history of adding and removing each address
Threat intelligenceToolsApache-2.0Release v2.0.1, Feb 2, 201935 stars
Inactive last commit 1384 days ago
Commits in 0 of the last 52 weeks
-
ElastAlert
Easy & Flexible Alerting With ElasticSearch
Detection engineeringDetection, Alerting and Automation PlatformsApache-2.0Release v0.0.52, Jun 25, 20158K stars
- Listed as Yelp/elastalert, since renamed or moved
Inactive last commit 1438 days ago
Commits in 0 of the last 52 weeks
-
Elastalert | Yelp
Easy & Flexible Alerting With ElasticSearch
Detection engineeringLogging, Monitoring & Data SourcesApache-2.0Release v0.0.52, Jun 25, 20158K stars
Inactive last commit 1438 days ago
Commits in 0 of the last 52 weeks
-
AppMon
Documentation:
Penetration testingMobile Penetration TestingApache-2.0Release 0.5, Feb 12, 20181.6K stars
Archived archived by the owner, last commit 1441 days ago
Commits in 0 of the last 52 weeks
-
Aurora Incident Response
cyb3rfox/Aurora-Incident-Response
Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders
Incident responseTimeline ToolsApache-2.0Release 0.6.6, Mar 29, 20211.1K stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 1455 days ago
Commits in 0 of the last 52 weeks
-
OneMillion
Determine if a domain is in the Alexa or Cisco top one million domain list.
Threat intelligenceToolsMIT9 stars
- No published releases
Inactive last commit 1461 days ago
Commits in 0 of the last 52 weeks
-
Netdiscover
netdiscover
Penetration testingActive Information GatheringGPL-3.0408 stars
- No published releases
Inactive last commit 1468 days ago
Commits in 0 of the last 52 weeks
-
impfuzzy
Fuzzy Hash calculated from import API of PE files
Malware analysisFile SignatureGPL-2.091 stars
- No published releases
Inactive last commit 1516 days ago
Commits in 0 of the last 52 weeks
-
zeek2es
A Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio. This app can also output pure JSON logs to stdout for further processing!
Network monitoringIDS / IPS / Host IDS / Host IPSBSD-3-ClauseRelease v0.3.15, Aug 18, 202241 stars
Inactive last commit 1523 days ago
Commits in 0 of the last 52 weeks
-
StreamAlert
StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
Incident responseLog Analysis ToolsApache-2.0Release v3.5.0, Nov 4, 20212.9K stars
Inactive last commit 1552 days ago
Commits in 0 of the last 52 weeks
-
Andriller
📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
Digital forensicsMobile ForensicsMITRelease 3.6.3, Apr 30, 20221.6K stars
Inactive last commit 1575 days ago
Commits in 0 of the last 52 weeks
-
AChoir
Windows Live Artifacts Acquisition Script
Incident responseWindows Evidence CollectionGPL-2.0Release 4.4a, Aug 8, 2020195 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 1582 days ago
Commits in 0 of the last 52 weeks
-
MISP-Taxii-Server
An OpenTAXII Configuration for MISP
Threat intelligenceToolsBSD-3-Clause88 stars
- No published releases
Inactive last commit 1589 days ago
Commits in 0 of the last 52 weeks
-
BlueBox
BlueBox Malware analysis Box and Cyber threat intelligence.
Threat intelligenceTools50 stars
- No license file
- No published releases
Inactive last commit 1647 days ago
Commits in 0 of the last 52 weeks
-
FATT
FATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic
Network monitoringFingerprinting ToolsBSD-3-Clause684 stars
- No published releases
Inactive last commit 1672 days ago
Commits in 0 of the last 52 weeks
-
cloud-forensics-utils
Python library to carry out DFIR analysis on the Cloud
Cloud securityDigital Forensics and Incident ResponseApache-2.0Release 20260917, Sep 17, 2026511 stars
Inactive last commit 1673 days ago
Commits in 0 of the last 52 weeks
-
Invoke-LiveResponse
Invoke-LiveResponse
Incident responseWindows Evidence CollectionMIT151 stars
- No published releases
Inactive last commit 1701 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 1710 days ago
Commits in 0 of the last 52 weeks
-
OpenBackupExtractor
A free program for extracting data (like voicemails) from iPhone and iPad backups.
Digital forensicsMobile ForensicsGPL-3.0Release 1.1, Mar 21, 2018192 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 1748 days ago
Commits in 0 of the last 52 weeks
-
Pafish
Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do
Malware analysisAnti-Analysis DetectorGPL-3.0Release v0.6, Nov 9, 20213.9K stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 1805 days ago
Commits in 0 of the last 52 weeks
-
MozDef
DEPRECATED - MozDef: Mozilla Enterprise Defense Platform
Incident responseAll-In-One ToolsMPL-2.0Release v3.1.2, Oct 4, 20192.2K stars
Archived archived by the owner, last commit 1812 days ago
Commits in 0 of the last 52 weeks
-
sysmon-config
Sysmon configuration file template with default high-quality event tracing
Detection engineeringConfiguration5.7K stars
- No license file
- No published releases
Inactive last commit 1829 days ago
Commits in 0 of the last 52 weeks
-
CyLR
CyLR - Live Response Collection Tool
Incident responseEvidence CollectionGPL-3.0Release 2.2.0, Feb 3, 2021736 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 1833 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 1843 days ago
Commits in 0 of the last 52 weeks
-
cabby
TAXII client implementation from EclecticIQ
Threat intelligenceToolsLicense: other105 stars
- No published releases
Inactive last commit 1872 days ago
Commits in 0 of the last 52 weeks
-
Repokid Least Privilege
AWS Least Privilege for Distributed, High-Velocity Deployment
Cloud securityContinuous Security AuditingApache-2.0Release v0.19.8, Aug 25, 20211.1K stars
Inactive last commit 1881 days ago
Commits in 0 of the last 52 weeks
-
PEframe
PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.
Malware analysisDetection and ClassificationRelease 6.0.3, Jul 3, 2019628 stars
- No license file
Inactive last commit 1912 days ago
Commits in 0 of the last 52 weeks
-
AWS IR
Python installable command line utiltity for mitigation of host and key compromises.
Cloud securityDigital Forensics and Incident ResponseMITRelease v0.3.2, Jul 8, 2018342 stars
Inactive last commit 1923 days ago
Commits in 0 of the last 52 weeks
-
SyntheticSun
SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats.
Cloud securityContinuous Security AuditingGPL-3.082 stars
- No published releases
Inactive last commit 1930 days ago
Commits in 0 of the last 52 weeks
-
Disable keys after X days
A small lambda script that will disable access keys older than a given amount of days.
Cloud securityContinuous Security AuditingISCRelease 1.1.2, Mar 14, 2018154 stars
Inactive last commit 1932 days ago
Commits in 0 of the last 52 weeks
-
VolatilityBot
VolatilityBot – An automated memory analyzer for malware samples and memory dumps
Incident responseMemory Analysis ToolsMIT269 stars
- No published releases
Inactive last commit 1953 days ago
Commits in 0 of the last 52 weeks
-
jager
Hunting IOCs all day every day...
Threat intelligenceToolsLicense: other89 stars
- No published releases
Inactive last commit 1980 days ago
Commits in 0 of the last 52 weeks
-
cloudtrail-partitioner
duo-labs/cloudtrail-partitioner
Cloud securityDigital Forensics and Incident ResponseBSD-3-ClauseRelease 1.0.0.1, Apr 23, 2020159 stars
Inactive last commit 1987 days ago
Commits in 0 of the last 52 weeks
-
Cuckoo Sandbox
Cuckoo Sandbox is an automated dynamic malware analysis system
Malware analysisDynamic Analysis ToolsLicense: otherRelease 2.0.6, Jun 7, 20186K stars
Archived archived by the owner, last commit 2002 days ago
Commits in 0 of the last 52 weeks
-
NTFS USN Journal parser
PoorBillionaire/USN-Journal-Parser
Python script to parse the NTFS USN Journal
Digital forensicsNTFS/MFT ProcessingLicense: other119 stars
- No published releases
Inactive last commit 2002 days ago
Commits in 0 of the last 52 weeks
-
libtaxii
A Python library for handling TAXII Messages invoking TAXII Services.
Threat intelligenceToolsBSD-3-ClauseRelease 1.1.119, Apr 15, 202174 stars
Inactive last commit 2008 days ago
Commits in 0 of the last 52 weeks
-
Softrace
Lightweight and fast NSRL RDS storage
Threat intelligenceToolsApache-2.04 stars
- No published releases
Inactive last commit 2029 days ago
Commits in 0 of the last 52 weeks
-
IE10Analyzer
http://moaistory.blogspot.com/2016/08/ie10analyzer.html
Digital forensicsInternet ArtifactsMITRelease 1.0.0.6, Jul 20, 202420 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2051 days ago
Commits in 0 of the last 52 weeks
-
WinSearchDBAnalyzer
http://moaistory.blogspot.com/2018/10/winsearchdbanalyzer.html
Digital forensicsInternet ArtifactsMITRelease 1.0.0.6, Jul 20, 2024134 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2051 days ago
Commits in 0 of the last 52 weeks
-
nsrllookup
Checks with NSRL RDS servers looking for for hash matches
Malware analysisDetection and ClassificationISCRelease 1.4.2, Sep 16, 2019116 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2061 days ago
Commits in 0 of the last 52 weeks
-
ir-rescue
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
Incident responseEvidence CollectionLicense: other489 stars
- No published releases
Inactive last commit 2066 days ago
Commits in 0 of the last 52 weeks
-
Security Monkey
Security Monkey monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.
Cloud securityContinuous Security AuditingApache-2.0Release 1.1.3, May 24, 20184.4K stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 2077 days ago
Commits in 0 of the last 52 weeks
-
FastIR Collector
Incident responseWindows Evidence CollectionGPL-3.0Release V1.1, May 16, 2017516 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2093 days ago
Commits in 0 of the last 52 weeks
-
FastIR Collector Linux
SekoiaLab/Fastir_Collector_Linux
Incident responseLinux Evidence CollectionGPL-3.0177 stars
- No published releases
Inactive last commit 2093 days ago
Commits in 0 of the last 52 weeks
-
Kolide Fleet
A flexible control server for osquery fleets
Detection engineeringEndpoint MonitoringMITRelease 3.2.0, Oct 8, 20201.1K stars
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 2134 days ago
Commits in 0 of the last 52 weeks
-
dnSpy
.NET debugger and assembly editor
Reverse engineering.NET DecompilersRelease v6.1.8, Dec 7, 202029.7K stars
- No license file
- Latest release has downloads without a signature or checksum file
Archived archived by the owner, last commit 2142 days ago
Commits in 0 of the last 52 weeks
-
Stenographer
Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com
Network monitoringNetwork MonitoringApache-2.01.8K stars
- No published releases
Archived archived by the owner, last commit 2149 days ago
Commits in 0 of the last 52 weeks
-
Zeek Agent
This project is no longer maintained. There's a successor at https://github.com/zeek/zeek-agent-v2
Detection engineeringEndpoint MonitoringLicense: other122 stars
- No published releases
Archived archived by the owner, last commit 2161 days ago
Commits in 0 of the last 52 weeks
-
Hoarder
This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.
Incident responseWindows Evidence CollectionGPL-3.0Release 4.0.0, Aug 5, 2020217 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2191 days ago
Commits in 0 of the last 52 weeks
-
Rekall
Rekall Memory Forensic Framework
Digital forensicsMemory ForensicsGPL-2.0Release v1.7.1, Nov 6, 20172K stars
Archived archived by the owner, last commit 2193 days ago
Commits in 0 of the last 52 weeks
-
PrismX
Cloud Security Dashboard for AWS - based on ScoutSuite
Cloud securityContinuous Security AuditingGPL-2.01 stars
- Listed as omaidf/PrismX, since renamed or moved
- No published releases
Inactive last commit 2201 days ago
Commits in 0 of the last 52 weeks
-
aws-fast-fixes
Scripts to quickly fix security and compliance issues
Cloud securityDigital Forensics and Incident ResponseApache-2.0108 stars
- No published releases
Archived archived by the owner, last commit 2226 days ago
Commits in 0 of the last 52 weeks
-
FingerprinTLS
LeeBrotherston/tls-fingerprinting
TLS Fingerprinting
Network monitoringFingerprinting ToolsGPL-3.0Release 1.0.1, Jul 31, 2016399 stars
Archived archived by the owner, last commit 2232 days ago
Commits in 0 of the last 52 weeks
-
aws-auto-remediate
Open source application to instantly remediate common security issues through the use of AWS Config
Cloud securityDigital Forensics and Incident ResponseGPL-3.0Release v1.0, May 20, 2019217 stars
- Listed as servian/aws-auto-remediate, since renamed or moved
Archived archived by the owner, last commit 2237 days ago
Commits in 0 of the last 52 weeks
-
de4dot
.NET deobfuscator and unpacker.
Malware analysisDeobfuscationGPL-3.07.4K stars
- Listed as 0xd4d/de4dot, since renamed or moved
- No published releases
Archived archived by the owner, last commit 2243 days ago
Commits in 0 of the last 52 weeks
-
Sublist3r
Fast subdomains enumeration tool for penetration testers
Penetration testingPenetration TestingGPL-2.0Release 1.1, Apr 6, 202011.1K stars
Inactive last commit 2274 days ago
Commits in 0 of the last 52 weeks
-
OSX Auditor
OS X Auditor is a free Mac OS X computer forensics tool
Incident responseOSX Evidence CollectionLicense: other3.1K stars
- No published releases
Inactive last commit 2275 days ago
Commits in 0 of the last 52 weeks
-
AppCompatProcessor
mbevilacqua/appcompatprocessor
"Evolving AppCompat/AmCache data analysis beyond grep"
Incident responseLog Analysis ToolsApache-2.0215 stars
- No published releases
Inactive last commit 2320 days ago
Commits in 0 of the last 52 weeks
-
MEAT
This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices
Digital forensicsMobile ForensicsGPL-3.0Release v1.0.3, Apr 22, 2020168 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 2343 days ago
Commits in 0 of the last 52 weeks
-
RDFP
Remote Desktop Client Fingerprint script for Zeek. Based off of https://github.com/0x4D31/fatt
Network monitoringFingerprinting ToolsApache-2.040 stars
- Listed as yahoo/rdfp, since renamed or moved
- No published releases
Inactive last commit 2348 days ago
Commits in 0 of the last 52 weeks
-
unxor
unXOR will search a XORed file and try to guess the key using known-plaintext attacks.
Malware analysisDeobfuscationApache-2.0145 stars
- No published releases
Inactive last commit 2370 days ago
Commits in 0 of the last 52 weeks
-
Cloud Inquisitor
Enforce ownership and data security within AWS
Cloud securityContinuous Security AuditingApache-2.0Release 2.2.0, Sep 24, 2018445 stars
Archived archived by the owner, last commit 2377 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 2392 days ago
Commits in 0 of the last 52 weeks
-
osquery-configuration
palantir/osquery-configuration
A repository for using osquery for incident detection and response
Detection engineeringConfigurationLicense: other906 stars
- No published releases
Inactive last commit 2398 days ago
Commits in 0 of the last 52 weeks
-
Varna
Varna: Quick & Cheap AWS CloudTrail Monitoring with Event Query Language (EQL)
Cloud securityDigital Forensics and Incident ResponseApache-2.052 stars
- No published releases
Inactive last commit 2443 days ago
Commits in 0 of the last 52 weeks
-
BinaryAlert
BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.
Malware analysisDetection and ClassificationApache-2.0Release v1.2.0, Sep 5, 20181.5K stars
Inactive last commit 2461 days ago
Commits in 0 of the last 52 weeks
-
Cold Disk Quick Response
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
Incident responseEvidence CollectionGPL-3.0Release 20191226, Dec 26, 2019346 stars
- Listed as rough007/CDQR, since renamed or moved
- Latest release has downloads without a signature or checksum file
Inactive last commit 2489 days ago
Commits in 0 of the last 52 weeks
-
GDPatrol
A Lambda-powered Security Orchestration framework for AWS GuardDuty
Cloud securityDigital Forensics and Incident ResponseMIT53 stars
- No published releases
Archived archived by the owner, last commit 2500 days ago
Commits in 0 of the last 52 weeks
-
fargate-ir
Proof of concept incident response demo using SSM and AWS Fargate.
Cloud securityDigital Forensics and Incident ResponseLicense: other15 stars
- No published releases
Inactive last commit 2510 days ago
Commits in 0 of the last 52 weeks
-
Beagle
Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
Digital forensicsWindows ArtifactsMITRelease v1.0.5, May 28, 20191.4K stars
Inactive last commit 2513 days ago
Commits in 0 of the last 52 weeks
-
nightHawk
biggiesmallsAG/nightHawkResponse
Incident Response Forensic Framework
Incident responseAll-In-One ToolsRelease 1.0.3, Sep 1, 2016607 stars
- No license file
Inactive last commit 2526 days ago
Commits in 0 of the last 52 weeks
-
Joy
A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
Network monitoringNetwork MonitoringLicense: other1.4K stars
- No published releases
Archived archived by the owner, last commit 2537 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 2538 days ago
Commits in 0 of the last 52 weeks
-
AbuseHelper
A framework for receiving and redistributing abuse feeds
Threat intelligenceFrameworks and PlatformsMITRelease v5.7.0, Feb 12, 2019125 stars
Inactive last commit 2579 days ago
Commits in 0 of the last 52 weeks
-
CyBot
Open Source Threat Intelligence Chat Bot
Threat intelligenceTools317 stars
- Listed as CylanceSPEAR/CyBot, since renamed or moved
- No license file
- No published releases
Inactive last commit 2589 days ago
Commits in 0 of the last 52 weeks
-
mig
Distributed & real time digital forensics at the speed of the cloud
Digital forensicsLive ForensicsMPL-2.01.2K stars
- No published releases
Archived archived by the owner, last commit 2593 days ago
Commits in 0 of the last 52 weeks
-
SRA TAXII2 Server
SecurityRiskAdvisors/sra-taxii2-server
TAXII 2.0 Server implemented in Node JS with MongoDB backend
Threat intelligenceToolsMIT12 stars
- No published releases
Archived archived by the owner, last commit 2609 days ago
Commits in 0 of the last 52 weeks
-
SSM-Acquire
A python module for orchestrating content acquisitions and analysis via amazon ssm.
Cloud securityDigital Forensics and Incident ResponseMPL-2.058 stars
- No published releases
Inactive last commit 2631 days ago
Commits in 0 of the last 52 weeks
-
Empire
Empire is a PowerShell and Python post-exploitation agent.
Penetration testingPenetration TestingBSD-3-ClauseRelease 2.5, Mar 15, 20187.8K stars
Archived archived by the owner, last commit 2637 days ago
Commits in 0 of the last 52 weeks
-
Hammer
Dow Jones Hammer : Protect the cloud with the power of the cloud(AWS)
Cloud securityContinuous Security AuditingLicense: other450 stars
- No published releases
Inactive last commit 2672 days ago
Commits in 0 of the last 52 weeks
-
dexter
Forensics acquisition framework designed to be extensible and secure
Digital forensicsFrameworksApache-2.0126 stars
- No published releases
Inactive last commit 2677 days ago
Commits in 0 of the last 52 weeks
-
OSX Collect
A forensic evidence collection & analysis toolkit for OS X
Digital forensicsOS X ForensicsLicense: otherRelease v1.10, Jun 15, 20181.9K stars
Archived archived by the owner, last commit 2679 days ago
Commits in 0 of the last 52 weeks
-
OSX Collector
A forensic evidence collection & analysis toolkit for OS X
Incident responseOSX Evidence CollectionLicense: otherRelease v1.10, Jun 15, 20181.9K stars
- Listed as yelp/osxcollector, since renamed or moved
Archived archived by the owner, last commit 2679 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 2700 days ago
Commits in 0 of the last 52 weeks
-
Archived archived by the owner, last commit 2708 days ago
Commits in 0 of the last 52 weeks
-
YETI
YETI is a TAXII implementation
Threat intelligenceToolsBSD-3-Clause47 stars
- No published releases
Archived archived by the owner, last commit 2719 days ago
Commits in 0 of the last 52 weeks
-
pehash
Compilation of peHash implementations.
Malware analysisFile SignatureRelease v0.9.0, Sep 27, 201715 stars
- No license file
Inactive last commit 2728 days ago
Commits in 0 of the last 52 weeks
-
AWSlog
Show the history and changes between configuration versions of AWS resources
Cloud securityDigital Forensics and Incident ResponseMIT70 stars
- No published releases
Archived archived by the owner, last commit 2768 days ago
Commits in 0 of the last 52 weeks
-
Krampus
The original AWS security enforcer™
Cloud securityContinuous Security AuditingMIT62 stars
- No published releases
Inactive last commit 2785 days ago
Commits in 0 of the last 52 weeks
-
Lorg
Apache Logfile Security Analyzer
Incident responseLog Analysis ToolsGPL-2.0215 stars
- No published releases
Inactive last commit 2796 days ago
Commits in 0 of the last 52 weeks
-
Scumblr
Web framework that allows performing periodic syncs of data sources and performing analysis on the identified results
Threat intelligenceFrameworks and PlatformsApache-2.0Release 2.1.0, Sep 25, 20172.6K stars
- Listed as Netflix/Scumblr, since renamed or moved
Inactive last commit 2813 days ago
Commits in 0 of the last 52 weeks
-
File Scanning Framework
File Scanning Framework
Malware analysisDetection and ClassificationApache-2.0294 stars
- No published releases
Inactive last commit 2821 days ago
Commits in 0 of the last 52 weeks
-
MultiScanner
Modular file scanning/analysis framework
Malware analysisDetection and ClassificationLicense: otherRelease 2.0.0, Jan 28, 2019620 stars
Inactive last commit 2821 days ago
Commits in 0 of the last 52 weeks
-
Doorman
an osquery fleet manager
Incident responseAll-In-One ToolsMITRelease v0.6, Sep 5, 2017621 stars
Inactive last commit 2845 days ago
Commits in 0 of the last 52 weeks
-
ManaTI
A web-based tool to assist the work of the intuitive threat analysts.
Threat intelligenceFrameworks and PlatformsRelease v0.12.2a, Nov 11, 2018114 stars
- No license file
Inactive last commit 2845 days ago
Commits in 0 of the last 52 weeks
-
aws-logsearch
Cloud securityDigital Forensics and Incident ResponseMITRelease 0.0.1, Dec 10, 201825 stars
Inactive last commit 2870 days ago
Commits in 0 of the last 52 weeks
-
GoatRider
GoatRider is a simple tool that will dynamically pull down Artillery Threat Intelligence Feeds, TOR, AlienVaults OTX, and the Alexa top 1 million websites and do a comparison to a hostname file or IP file.
Threat intelligenceToolsLicense: other145 stars
- No published releases
Inactive last commit 2890 days ago
Commits in 0 of the last 52 weeks
-
MalPipe
Malware/IOC ingestion and processing engine
Threat intelligenceToolsGPL-3.0110 stars
- No published releases
Inactive last commit 2890 days ago
Commits in 0 of the last 52 weeks
-
iOS Frequent Locations Dumper
mac4n6/iOS-Frequent-Locations-Dumper
Dump the iOS Frequent Location binary plist files
Digital forensicsMobile Forensics92 stars
- No license file
- No published releases
Inactive last commit 2906 days ago
Commits in 0 of the last 52 weeks
-
Hippocampe
Threat Feed Aggregation, Made Easy
Threat intelligenceToolsAGPL-3.0Release 1.0.0, Jan 18, 2017169 stars
Archived archived by the owner, last commit 2922 days ago
Commits in 0 of the last 52 weeks
-
openioc-to-stix
Generate STIX XML from OpenIOC XML
Threat intelligenceToolsBSD-3-ClauseRelease v1.4.0, Oct 17, 201897 stars
Inactive last commit 2923 days ago
Commits in 0 of the last 52 weeks
-
Generic File Parser
A Single Library Parser to extract meta information,static analysis and detect macros within the files.
Malware analysisDetection and ClassificationMIT3 stars
- No published releases
Inactive last commit 2957 days ago
Commits in 0 of the last 52 weeks
-
Laika BOSS
Laika BOSS: Object Scanning System
Digital forensicsFrameworksApache-2.0754 stars
- No published releases
Inactive last commit 2960 days ago
Commits in 0 of the last 52 weeks
-
MacLocationsScraper
macOS/iOS database location scraper to extract location data
Digital forensicsOS X Forensics92 stars
- No license file
- No published releases
Inactive last commit 2964 days ago
Commits in 0 of the last 52 weeks
-
Watchmen
(Not maintained anymore) Watchmen - AWS account compliance using centrally managed Config Rules
Cloud securityContinuous Security AuditingApache-2.0176 stars
- No published releases
Inactive last commit 2967 days ago
Commits in 0 of the last 52 weeks
-
Hiryu
IOC Management and Visualization Tool
Threat intelligenceTools48 stars
- No license file
- No published releases
Inactive last commit 2971 days ago
Commits in 0 of the last 52 weeks
-
Yara Finder
Simple tool to find the yara matches on a file
Malware analysisDetection and ClassificationMITRelease 1.0.0, Aug 24, 20182 stars
Inactive last commit 2975 days ago
Commits in 0 of the last 52 weeks
-
rastrea2r
Collecting & Hunting for IOCs with gusto and style
Threat intelligenceTools118 stars
- No license file
- No published releases
Inactive last commit 2993 days ago
Commits in 0 of the last 52 weeks
-
cacador
Indicator Extractor
Threat intelligenceToolsMITRelease v0.0.1, Apr 3, 2016141 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 3019 days ago
Commits in 0 of the last 52 weeks
-
Threat-Intelligence-Hunter
abhinavbom/Threat-Intelligence-Hunter
TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own local database of indicators.
Threat intelligenceToolsMIT157 stars
- No published releases
Inactive last commit 3024 days ago
Commits in 0 of the last 52 weeks
-
Margarita Shotgun
ThreatResponse/margaritashotgun
Remote Memory Acquisition Tool
Incident responseEvidence CollectionMITRelease v0.4.1, Jul 21, 2017253 stars
Inactive last commit 3044 days ago
Commits in 0 of the last 52 weeks
-
NoMoreXOR
Tool to help guess a files 256 byte XOR key by using frequency analysis
Malware analysisDeobfuscation90 stars
- No license file
- No published releases
Inactive last commit 3052 days ago
Commits in 0 of the last 52 weeks
-
PowerForensics
PowerForensics provides an all in one platform for live disk forensic analysis
Incident responseWindows Evidence CollectionMITRelease 1.1.1, Jan 30, 20161.4K stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 3104 days ago
Commits in 0 of the last 52 weeks
-
poortego
Open-source python project to handle the storage and linking of open-source intelligence (ala Maltego)
Threat intelligenceToolsMIT122 stars
- No published releases
Inactive last commit 3113 days ago
Commits in 0 of the last 52 weeks
-
PackerAttacker
C++ application that uses memory and code hooks to detect packers
Malware analysisDeobfuscationGPL-2.0275 stars
- No published releases
Inactive last commit 3151 days ago
Commits in 0 of the last 52 weeks
-
Malstrom
Cyber Intel Management
Threat intelligenceFrameworks and PlatformsMIT50 stars
- Listed as byt3smith/malstrom, since renamed or moved
- No published releases
Archived archived by the owner, last commit 3189 days ago
Commits in 0 of the last 52 weeks
-
Forager
Multithreaded threat Intelligence gathering built with Python3
Threat intelligenceToolsMITRelease v2.0.3, Apr 12, 2016178 stars
- Listed as byt3smith/Forager, since renamed or moved
Inactive last commit 3191 days ago
Commits in 0 of the last 52 weeks
-
Archived archived by the owner, last commit 3234 days ago
Commits in 0 of the last 52 weeks
-
macMRUParser
Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format.
Digital forensicsOS X Forensics111 stars
- No license file
- No published releases
Inactive last commit 3235 days ago
Commits in 0 of the last 52 weeks
-
Evolve
Web interface for the Volatility Memory Forensics Framework
Incident responseMemory Analysis ToolsRelease v1.6, Nov 16, 2017258 stars
- No license file
Inactive last commit 3255 days ago
Commits in 0 of the last 52 weeks
-
CimSweep
CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
Incident responseAll-In-One ToolsBSD-3-ClauseRelease v0.6.1.1, Jun 8, 2017656 stars
- Listed as PowerShellMafia/CimSweep, since renamed or moved
Inactive last commit 3318 days ago
Commits in 0 of the last 52 weeks
-
VolDiff
VolDiff: Malware Memory Footprint Analysis based on Volatility
Incident responseMemory Analysis ToolsBSD-2-ClauseRelease v2.1, Jun 18, 2015195 stars
- Listed as aim4r/VolDiff, since renamed or moved
Archived archived by the owner, last commit 3324 days ago
Commits in 0 of the last 52 weeks
-
python-ntfs
Open source Python library for NTFS analysis
Digital forensicsNTFS/MFT ProcessingApache-2.086 stars
- No published releases
Inactive last commit 3332 days ago
Commits in 0 of the last 52 weeks
-
ActorTrackr
Home to the ActorTrackr source code
Threat intelligenceToolsLicense: other31 stars
- Fork of another repository
- No published releases
Inactive last commit 3336 days ago
Commits in 0 of the last 52 weeks
-
hashdeep
Malware analysisDetection and ClassificationLicense: otherRelease v4.4, Jan 29, 2014789 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 3343 days ago
Commits in 0 of the last 52 weeks
-
PSRecon
:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
Incident responseWindows Evidence CollectionApache-2.0494 stars
- No published releases
Inactive last commit 3369 days ago
Commits in 0 of the last 52 weeks
-
threatcmd
Cli interface to threatcrowd.org
Threat intelligenceToolsMIT21 stars
- No published releases
Inactive last commit 3392 days ago
Commits in 0 of the last 52 weeks
-
threatcrowdapi
Python wrapper for threatcrowd's api
Threat intelligenceToolsMIT10 stars
- No published releases
Inactive last commit 3392 days ago
Commits in 0 of the last 52 weeks
-
iocparser
Tool to extract indicators of compromise from security reports in PDF format
Threat intelligenceToolsMIT439 stars
- No published releases
Inactive last commit 3414 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 3431 days ago
Commits in 0 of the last 52 weeks
-
CIRTkit
Tools for the Computer Incident Response Team :computer:
Incident responseAll-In-One ToolsMIT153 stars
- Listed as byt3smith/CIRTKit, since renamed or moved
- No published releases
Inactive last commit 3472 days ago
Commits in 0 of the last 52 weeks
-
Megatron
Megatron - A System for Abuse- and Incident Handling
Threat intelligenceFrameworks and PlatformsApache-2.0Release v.1.1.1, Mar 29, 201745 stars
Inactive last commit 3491 days ago
Commits in 0 of the last 52 weeks
-
Lazy Office Analyzer
Lazy Office Analyzer
Malware analysisMicrosoft Office122 stars
- No license file
- No published releases
Inactive last commit 3533 days ago
Commits in 0 of the last 52 weeks
-
Panorama
Fast incident overview
Incident responseWindows Evidence Collection41 stars
- No license file
- No published releases
Inactive last commit 3537 days ago
Commits in 0 of the last 52 weeks
-
VolUtility
Web App for Volatility framework
Digital forensicsMemory ForensicsGPL-3.0Release v1.2, Jan 3, 2017389 stars
Inactive last commit 3559 days ago
Commits in 0 of the last 52 weeks
-
pee-pdf
Powerful Python tool to analyze PDF documents
Malware analysisPDFGPL-3.01.5K stars
- No published releases
Inactive last commit 3623 days ago
Commits in 0 of the last 52 weeks
-
stix-viz
STIX Visualization Tool
Threat intelligenceToolsBSD-3-ClauseRelease v1.0.7a, Jul 13, 2018111 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 3680 days ago
Commits in 0 of the last 52 weeks
-
HashCheck
HashCheck Shell Extension for Windows with added SHA2, SHA3, and multithreading; originally from code.kliu.org
Malware analysisDetection and ClassificationLicense: otherRelease v2.4.0, Sep 7, 20162.1K stars
- Latest release has a checksum file but no signature
Inactive last commit 3694 days ago
Commits in 0 of the last 52 weeks
-
ibmxforceex.checker.py
johestephan/ibmxforceex.checker.py
Python based client for IBM XForce Exchange
Threat intelligenceToolsApache-2.026 stars
- No published releases
Archived archived by the owner, last commit 3727 days ago
Commits in 0 of the last 52 weeks
-
Combine
Tool to gather Threat Intelligence indicators from publicly available sources
Threat intelligenceToolsGPL-3.0Release v0.1.3, Apr 27, 2015654 stars
Inactive last commit 3737 days ago
Commits in 0 of the last 52 weeks
-
Automater
Automater - IP URL and MD5 OSINT Analysis
Threat intelligenceToolsMIT557 stars
- No published releases
Inactive last commit 3794 days ago
Commits in 0 of the last 52 weeks
-
QRadio
QRadio ~ Best Threat Intelligence Radio ~ Tune In!
Threat intelligenceToolsApache-2.0Release v1.4.0, Mar 9, 2016101 stars
Inactive last commit 3804 days ago
Commits in 0 of the last 52 weeks
-
dff
DFF (Digital Forensics Framework) is a Forensics Framework coming with command line and graphical interfaces. DFF can be used to investigate hard drives and volatile memory and create reports about user and system activities.
Digital forensicsFrameworksGPL-2.0Release 1.4.0, Feb 13, 2020317 stars
- Latest release has downloads without a signature or checksum file
Inactive last commit 3806 days ago
Commits in 0 of the last 52 weeks
-
IRTriage
Incident Response Triage - Windows Evidence Collection for Forensic Analysis
Incident responseWindows Evidence Collection139 stars
- No license file
- No published releases
Inactive last commit 3833 days ago
Commits in 0 of the last 52 weeks
-
unpacker
Automated malware unpacker
Malware analysisDeobfuscation122 stars
- No license file
- No published releases
Inactive last commit 3881 days ago
Commits in 0 of the last 52 weeks
-
Inactive last commit 3946 days ago
Commits in 0 of the last 52 weeks
-
Malfunction
Malware Analysis Tool using Function Level Fuzzy Hashing
Malware analysisDetection and ClassificationLGPL-2.1191 stars
- No published releases
Inactive last commit 3961 days ago
Commits in 0 of the last 52 weeks
-
Harbinger Threat Intelligence
Harbinger Threat Intelligence
Threat intelligenceTools82 stars
- No license file
- No published releases
Archived archived by the owner, last commit 3968 days ago
Commits in 0 of the last 52 weeks
-
bro-intel-generator
Script for generating Bro intel files from pdf or html reports
Threat intelligenceToolsMIT76 stars
- No published releases
Archived archived by the owner, last commit 3969 days ago
Commits in 0 of the last 52 weeks
-
KeeFarce
Extracts passwords from a KeePass 2.x database, directly from memory.
Digital forensicsMemory ForensicsBSD-3-Clause1K stars
- No published releases
Inactive last commit 3990 days ago
Commits in 0 of the last 52 weeks
-
tiq-test
Threat Intelligence Quotient Test - Dataviz and Statistical Analysis of TI feeds
Threat intelligenceToolsGPL-3.0Release v0.2.0, Feb 1, 2015179 stars
Inactive last commit 4019 days ago
Commits in 0 of the last 52 weeks
-
MASTIFF
Malware static analysis framework
Malware analysisDetection and Classification184 stars
- No license file
- No published releases
Archived archived by the owner, last commit 4045 days ago
Commits in 0 of the last 52 weeks
-
TARDIS
Threat Analysis, Reconnaissance, and Data Intelligence System
Threat intelligenceFrameworks and PlatformsApache-2.0125 stars
- No published releases
Inactive last commit 4070 days ago
Commits in 0 of the last 52 weeks
-
PyIOCe
Python IOC Editor
Threat intelligenceToolsApache-2.066 stars
- Listed as yahoo/PyIOCe, since renamed or moved
- No published releases
Archived archived by the owner, last commit 4242 days ago
Commits in 0 of the last 52 weeks
-
ThreatTracker
ThreatTracker is a Python script designed to monitor and generate alerts on given sets of indicators of compromise (IOCs) indexed by a set of Google Custom Search Engines.
Threat intelligenceTools71 stars
- No license file
- No published releases
Inactive last commit 4242 days ago
Commits in 0 of the last 52 weeks
-
dnsenum
dnsenum is a perl script that enumerates DNS information
Penetration testingActive Information GatheringRelease 1.2.4.2, Feb 20, 2015712 stars
- No license file
Inactive last commit 4259 days ago
Commits in 0 of the last 52 weeks
-
Threatelligence
Threatelligence is a simple cyber threat intelligence feed collector, using Elasticsearch, Kibana and Python to automatically collect intelligence from custom or public sources. Automatically updates feeds and tries to further enhance data for dashboards.
Threat intelligenceTools152 stars
- No license file
- No published releases
Archived archived by the owner, last commit 4521 days ago
Commits in 0 of the last 52 weeks
-
CrowdFMS
CrowdStrike Feed Management System. CrowdFMS is a framework for automating collection and processing of samples from VirusTotal, by leveraging the Private API system. This framework automatically downloads recent samples, which triggered an alert on the users YARA notification feed.
Threat intelligenceToolsBSD-2-Clause133 stars
- No published releases
Archived archived by the owner, last commit 4631 days ago
Commits in 0 of the last 52 weeks
-
AnalyzePE
Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.
Malware analysisDetection and Classification211 stars
- No license file
- No published releases
Inactive last commit 4652 days ago
Commits in 0 of the last 52 weeks
-
IOCextractor
IOC (Indicator of Compromise) Extractor: a program to help extract IOCs from text files.
Threat intelligenceTools135 stars
- No license file
- No published releases
Inactive last commit 4773 days ago
Commits in 0 of the last 52 weeks
-
sshwatch
Intrusion Prevention System (IPS) for Secure Shell (SSH)
Network monitoringIDS / IPS / Host IDS / Host IPS55 stars
- No license file
- No published releases
Inactive last commit 4838 days ago
Commits in 0 of the last 52 weeks
-
Unavailable the repository was deleted or made private
-
Exabeam Content Library
ExabeamLabs/Content-Library-CIM2
Detection engineeringDetection Content & Signatures
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
-
Unavailable the repository was deleted or made private
No tools match these filters.