TuxResponse

TuxResponse v1.1 Linux Incident Response TuxResponse is incident response script for linux systems written in bash. It can automate incident response activities on Linux systems and enable you to triage systems quickly, while not compromising with the results. Usually corporate systems would have...

MacPersistenceChecker

MacPersistenceChecker See EVERYTHING that runs on your Mac. Understand WHY it runs. Decide WHAT stays. TL;DR MacPersistenceChecker shows you everything that runs automatically on your Mac , explains why it matters , and helps you decide what to keep or remove. → Find malware → Detect hidden...

rekono

Automate the recon, keep your time for the part that actually needs a hacker Think about how an assessment really starts. You gather public information about the target. You discover its hosts, enumerate their ports and identify the services behind them. Then you run a more specific tool against...

msidump

msidump MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner. On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we...

mac-monitor

🎉 Welcome to "Mac Monitor's" official new home! Mac Monitor is an advanced, stand-alone system monitoring tool tailor-made for macOS security research, malware triage, and system troubleshooting. Leveraging Apple's Endpoint Security ES and System Extension APIs, it collects and enriches system...

C0deVari4nt

C0deVari4nt Description C0deVari4nt is a variant analysis and visualisation tool that inspects codebases for similar vulnerabilities. It leverages CodeQL, a semantic code analysis engine, to query code based on user-controlled CodeQL query templates and passes the results to our client interface...

AFLTriage

AFLTriage AFLTriage is a tool to triage crashing input files using a debugger. It is designed to be portable and not require any run-time dependencies, besides libc and an external debugger. It supports triaging crashes generated by any program, not just AFL, but recognizes AFL directories...

LinuxCatScale

Linux-CatScale IR Collection Script Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the...

xori

Xori - Custom disassembly framework Xori is an automation-ready disassembly and static analysis library that consumes shellcode or PE binaries and provides triage analysis data. Acknowledgements: Xori wouldn't exist without inspiration and ideas from the open source community. We are indebted to...

malwoverview

Malwoverview !Alt...

nightHawkResponse

nightHawk Response Custom built application for asynchronus forensic data presentation on an Elasticsearch backend. This application is designed to ingest a Mandiant Redline "collections" file and give flexibility in search/stack and tagging. The application was born out of the inability to contr...

pftriage

pftriage pftriage is a tool to help analyze files during malware triage. It allows an analyst to quickly view and extract properties of a file to help during the triage process. The tool also has an analyze function which can detect common malicious indicators used by malware. Dependencies pefile...

gaia

Gaia - Attack Surface Discovery & AI-Assisted Triage Gaia is a CLI-first attack surface analysis tool that discovers endpoints and parameters, reduces noise, and highlights security-relevant risks using static heuristics and optional AI reasoning. It orchestrates Katana, gau, arjun, linkfinder, a...

ios_triage

iOS Triage Bash script to extract data from a "checkra1ned" iOS device Developed and tested on Mac OS X Mojave 10.14.6 Mandatory Requirements checkra1n https://checkra.in/ libimobiledevice https://www.libimobiledevice.org/ SSHPASS for Mac OS X https://gist.github.com/arunoda/7790979 dialog for Ma...

PETriage

PETriage A fast, cross-platform PE Portable Executable surface analysis tool for malware triage, written in Rust. Designed for analysts who need practical PE triage on Linux, macOS, and Windows without relying on a Windows-only workflow. Formerly readpe renamed to avoid naming collisions with...

SharpDPAPI

SharpDPAPI SharpDPAPI is a C port of some DPAPI functionality from @gentilkiwi's Mimikatz project. I did not come up with this logic, it is simply a port from Mimikatz in order to better understand the process and operationalize it to fit our workflow. The SharpChrome subproject is an adaptation ...

IRTriage

Incident Response Triage: Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael'...

SentinelThread-Forensics

🛡️ Sentinel Thread Pro The High-Speed Windows Forensic Triage Platform 📋 The Mission In modern SOC operations, manual EVTX analysis is a death sentence for your MTTR Mean Time to Respond. Sentinel Thread Pro is built to bridge the gap between massive raw event logs and actionable forensic...

machscope

machscope machscope is a terminal-native macOS explorer that turns processes, launchd jobs, Mach services, bundles, signatures, entitlements, and Mach-O linkage into one interrogable graph. It exists to answer a simple question brutally well: What is this process, service, binary, or bundle reall...

cve-mcp-server

🛡️ CVE MCP Server AI-powered security intelligence at your fingertips — 28 tools + a one-calltriagecve orchestrator, 24 data sources, one protocol. A production-grade Model Context Protocol MCP server that turns Claude into a full-spectrum security analyst. Instead of juggling 15+ browser tabs...