From Chaos to Clarity. Turning Raw Windows Logs into Executive Insights. Looking for Indicators of Compromise.
☆47Oct 20, 2025Updated last year
Alternatives and similar repositories for ThreatHunting
Users that are interested in ThreatHunting are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- PowerShell 'Hero': scripts for DFIR and automation with a PowerShell menu example.☆37Jul 11, 2023Updated 3 years ago
- A Python-based HTTP security header analyzer that identifies weak or missing policies (CSP, HSTS, XFO, etc.) and generates OWASP-aligned …☆13Nov 14, 2025Updated 11 months ago
- Sniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.☆20Jan 22, 2026Updated 9 months ago
- WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital s…☆126Oct 1, 2026Updated 3 weeks ago
- This tool is a modern evolution of older PoCs like those for CVE-2017-7921 and ICSA-17-124-01, updated for 2025 with live console output,…☆19Nov 19, 2025Updated 11 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- ☆24Oct 8, 2025Updated last year
- Ludus range for the Constructing Defense Lab☆142Jul 28, 2026Updated 3 months ago
- Active Directory snapshots from Linux and macOS in the AD Explorer .dat format. Opens in AD Explorer, works with ADExplorerSnapshot.py an…☆38Sep 11, 2026Updated last month
- Baseline a Windows System against LOLBAS☆77Jun 5, 2026Updated 4 months ago
- This C# tool sprays for admin access over the entire domain☆90Dec 7, 2025Updated 10 months ago
- High-speed, multi-threaded APT hunting tool designed for lateral movement detection and forensic artifact discovery in Windows environmen…☆15Feb 8, 2026Updated 8 months ago
- .NET tool used to enrich RPC telemetry☆102Jan 24, 2026Updated 9 months ago
- SANS Workshop: Active Directory Privilege Escalation with Empire!☆36Nov 12, 2025Updated 11 months ago
- Red Team tools containerized☆77Aug 28, 2026Updated 2 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- StickyParser - Sticky Notes Forensic. A Windows Sticky Notes Praser (snt and plum.sqlite supported). Additional Feature: SQLite Recovery …☆24Jul 18, 2023Updated 3 years ago
- PowerShell scripts to aid investigators when utilizing O365 and Magnet Axiom.☆13Aug 26, 2024Updated 2 years ago
- Abusing SSRF to deliver an authenticated command injection payload☆28Sep 1, 2025Updated last year
- A tool for locating memory character code☆11Mar 4, 2025Updated last year
- Hunt for SQLite files used by various applications☆33Oct 15, 2026Updated 2 weeks ago
- Dynamic shellcode loader with sophisticated evasion capabilities☆344Oct 1, 2025Updated last year
- PowerShell tools to help defenders hunt smarter, hunt harder.☆491Oct 29, 2025Updated last year
- BOF to terminate a process via PID as argument☆28Sep 7, 2025Updated last year
- Malformed Access Log to CSV - Convert Web Server Access Logs to CSV☆18Sep 3, 2024Updated 2 years ago
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- Harness fo malware analysis☆42Aug 23, 2026Updated 2 months ago
- Interactive PowerShell framework for testing WMI, COM, LOLBAS, and persistence techniques☆132Dec 28, 2025Updated 10 months ago
- A Python agent targeting Linux for Mythic C2☆18Mar 6, 2026Updated 7 months ago
- Wonka is a sweet Windows tool that extracts Kerberos tickets from the Local Security Authority (LSA) cache. Like finding a ticket, but fo…☆177Jun 19, 2026Updated 4 months ago
- Windows Access token manipulation tool made in C#☆25Aug 24, 2025Updated last year
- Signal Tracking & Detection☆35Mar 18, 2026Updated 7 months ago
- Lightweight binary that joins a device to a Tailscale network and exposes a local SOCKS5 proxy. Designed for red team operations and ephe…☆574Oct 3, 2025Updated last year
- Helping defenders learn and validate npm supply-chain detections with safe atomic tests.☆35Oct 30, 2025Updated 11 months ago
- The different ways to dump lsass☆290Jul 19, 2026Updated 3 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Just Another broken Registry Parser (JARP)☆16May 23, 2024Updated 2 years ago
- A Cyber Security expert curated list of useful browser bookmarks☆13Aug 23, 2025Updated last year
- Step-by-step documentation on how to decrypt SCCM database secrets offline☆50Oct 20, 2025Updated last year
- some leaked src code for known and unknown malwares☆23Aug 15, 2025Updated last year
- Permanently disable EDRs as local admin☆131Dec 19, 2025Updated 10 months ago
- A repo that contains links to projects by members of the Digital Forensics Discord Server! This is meant to help promote projects made by…☆25Apr 23, 2026Updated 6 months ago
- Forensic cheatsheets for use with cheat☆16Dec 2, 2021Updated 4 years ago