dfirtriage
travisfoley/dfirtriageDigital forensic acquisition tool for Windows based incident response.
digital-forensicsforensicsincident-response+1
347
travisfoley/dfirtriageDigital forensic acquisition tool for Windows based incident response.
sobri3195/pegasus-malware-scanMulti-layered malware scanner combining hash-based verification, behavioral analysis, and sandbox execution for threat detection, incident response,…
diogo-fernan/ir-rescueA Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
sekoialab/fastir_collectorLive Windows forensic acquisition tool that collects system artefacts (registry, memory, disk, files) into CSV/JSON for early compromise detection…
trustedsec/tscopyPython tool that parses the NTFS $MFT to copy locked files during incident response, bypassing OS locks by reading raw disk locations. Supports…
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
fireeye/pywintracePython ctypes wrapper for Event Tracing for Windows (ETW) enabling session control, event capture, and custom callbacks for security monitoring and…
jpcertcc/logontracerInvestigate malicious Windows logon by visualizing and analyzing Windows event log
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
nikaiw/vmkatzExtract Windows credentials directly from VM memory snapshots and virtual disks
yampelo/beagleBeagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
omerbenamram/evtxA Fast (and safe) parser for the Windows XML Event Log (EVTX) format
crowdstrike/supermemA python script developed to process Windows memory images based on triage type.
0vercl0k/kdmp-parserA Windows kernel dump C++ parser library with Python 3 bindings.
akefallonitis/larac2shellCross-platform interactive shell for Microsoft Defender for Endpoint Live Response
adham504/sentinelthread-forensicsHigh-speed Windows forensic triage platform that orchestrates the Hayabusa engine to transform raw EVTX logs into prioritized threat timelines with…
intrudify/mini-shai-hulud-scannerScanner for the Mini Shai-Hulud npm/PyPI supply chain worm (NHS CC-4781 · CVE-2026-45321). Detects gh-token-monitor persistence, payload artefacts,…
seyyidkadir/filedumperWindows memory forensics tool for dumping files from process memory regions, searching byte patterns (PDF, JPG, SWF), and performing live process…