fox-it

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT...

Active Directory ACL exploitation with BloodHound

Find vulnerable Log4j2 versions on disk and also inside Java Archive Files (Log4Shell CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)

A no-nonsense c-like structure parsing library for Python

Generating YARA rules based on binary code

Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles

Quantum Insert

A guide for setting up LUKS boot with a key from TPM in Linux

Parse evtx files and detect use of the DanderSpritz eventlogedit module

Python based BloodHound data importer

Open Dataset of Cobalt Strike Beacon metadata (2018-2022)

CryptoPHP Indicators of Compromise

Historical list of {Cobalt Strike,NanoHTTPD} servers

acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.

Project containing several tools/ scripts to recover the OpenSSH session keys used to encrypt/ decrypt SSH traffic.

The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file...

Dissect triage scripts for Citrix NetScaler devices

Project to decrypt and parse SSH traffic

A Dissect module implementing a parser for C-like structures.

A zero dependency and customizable Python library for scanning Windows and Linux process memory.

PCAP-over-IP server written in Golang

Bro-IDS scripts