MrHandler
emrekybs/mrhandlerSSH-based Linux incident response tool that executes diagnostic commands to collect network configs, logs, user accounts, and processes, then…
digital-forensicsforensicsincident-response+1
86
emrekybs/mrhandlerSSH-based Linux incident response tool that executes diagnostic commands to collect network configs, logs, user accounts, and processes, then…
la3ar0v/tuxresponseAutomated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.
sobri3195/pegasus-malware-scanMulti-layered malware scanner combining hash-based verification, behavioral analysis, and sandbox execution for threat detection, incident response,…
withsecurelabs/linuxcatscaleIncident Response collection and processing scripts with automated reporting scripts
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
cloud-sniper/cloud-sniperDetection-as-code platform that automates cloud security incident response by correlating artifacts, analyzing IOCs, and orchestrating…
0vercl0k/kdmp-parserA Windows kernel dump C++ parser library with Python 3 bindings.
akefallonitis/larac2shellCross-platform interactive shell for Microsoft Defender for Endpoint Live Response
sonitbahl/sshintelSelf-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.
intrudify/mini-shai-hulud-scannerScanner for the Mini Shai-Hulud npm/PyPI supply chain worm (NHS CC-4781 · CVE-2026-45321). Detects gh-token-monitor persistence, payload artefacts,…
techgaun/cve-2025-55182-scannerPython-based scanner for CVE-2025-55182 indicators of compromise. Checks filesystem paths, processes, systemd services, cron persistence, and…
intezer/linux-explorerEasy-to-use live forensics toolbox for Linux endpoints
msuhanov/easy_triageScripts to triage compromised systems (Linux, ESXi, FreeBSD/NetScaler)
fox-it/log4j-finderFind vulnerable Log4j2 versions on disk and also inside Java Archive Files (Log4Shell CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)
jpcertcc/malconfscanVolatility plugin for extracts configuration data of known malware
andreafortuna/autotimelinerAutomagically extract forensic timeline from volatile memory dump