Stars
A repository of DFIR-related Mind Maps geared towards the visual learners!
The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifa…
IATelligence is a Python script that will extract the IAT of a PE file and request GPT to get more information about the API and the ATT&CK matrix related
A curated list of awesome YARA rules, tools, and people.
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquir…
📚 Freely available programming books
A machine learning tool that ranks strings based on their relevance for malware analysis.
Some Powershell scripts, functions, stuff
Python script to decode common encoded PowerShell scripts
SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be r…
Windows System Call Tables (NT/2000/XP/2003/Vista/7/8/10/11)
Small and highly portable detection tests based on MITRE's ATT&CK.
A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.
ATT&CK Remote Threat Hunting Incident Response
A modular bug hunting and web application pentesting framework written in Go
Chrome DevTools Protocol
This repository serves as a place for community created Targets and Modules for use with KAPE.
Active Directory password filter featuring breached password checking and custom complexity rules
Digital Forensics artifact repository
In-depth attack surface mapping and asset discovery
Fast passive subdomain enumeration tool.
pcqf (PC Quick Forensics) helps quickly gathering forensic evidence from Windows, Mac, and Linux systems, in order to identify potential traces of compromise.
Privacy Possum makes tracking you less profitable
Pure go library for creating and processing Office Word (.docx), Excel (.xlsx) and Powerpoint (.pptx) documents
Zentral is a high-visibility platform for controlling Apple endpoints in enterprises. It brings great observability to IT and makes tracking & reporting compliance much less manual.