ioccheck A tool for simplifying the process of researching file hashes, IP addresses, and other indicators of compromise (IOCs). Features Look up hashes across multiple threat intelligence services, from a...
BeaconHunter Behavior-based monitoring and hunting tool built-in C# tool leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can...
RdpCacheStitcher RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps. Using raw RDP cache tile bitmaps extracted by tools like e.g. ANSSI’s BMC-Tools (https://github.com/ANSSI-FR/bmc-tools) as...
MemProcFS Analyzer MemProcFS-Analyzer.ps1 is a PowerShell script utilized to simplify the usage of MemProcFS and to assist with the analysis workflow. Features: Auto-Install of MemProcFS, EvtxECmd, Elasticsearch, Kibana Auto-Update of...
caronte Caronte is a tool to analyze the network flow during the capture of the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild...
siembol Siembol provides a scalable, advanced security analytics framework based on open-source big data technologies. It normalizes, enriches, and alerts on data from various sources which allows security teams to...
BitsParser A python tool to parse Windows Background Intelligent Transfer Service database files. Intro BitsParser is a Python 3 script that can parse Windows Background Intelligent Transfer Service database files...
The WinPmem memory acquisition driver and userspace WinPmem has been the default open-source memory acquisition driver for windows for a long time. It used to live in the Rekall project...
Judge Jury and Executable – A Threat Hunting Forensics Tool A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and...
Introducing TScopy It is a requirement during an Incident Response (IR) engagement to have the ability to analyze files on the filesystem. Sometimes these files are locked by the operating...
ldsview Offline search tool for LDAP directory dumps in LDIF format. Features Fast and memory-efficient parsing of LDIF files Build ldapsearch commands to extract an LDIF from a directory Show directory...
ipcdump ipcdump is a tool for tracing interprocess communication (IPC) on Linux. It covers most of the common IPC mechanisms — pipes, fifos, signals, Unix sockets, loopback-based networking, and pseudoterminals....
honeypots 16 different honeypots in a single PyPI package for monitoring network traffic, bots activities, and username \ password credentials. All honeypots are non-blocking and can be used as objects...
Columbo Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and...
IPED Digital Forensic Tool IPED is open-source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate...
Support Securityonline.info site. Thanks!
