RustyBlue is a rust implementation of DeepblueCLI, a forensics log analyzer for finding evidence of compromise from windows event logs.
☆73Oct 13, 2022Updated 4 years ago
Alternatives and similar repositories for RustyBlue
Users that are interested in RustyBlue are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆25Feb 13, 2021Updated 5 years ago
- Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.☆232Updated this week
- Sample evtx files to use for testing hayabusa detection rules☆72Nov 5, 2025Updated last year
- ARM Exploit 開発のためのトレーニングリポジトリ☆17May 23, 2020Updated 6 years ago
- ☆37Oct 4, 2020Updated 6 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）☆774Feb 3, 2023Updated 3 years ago
- A fork of the evtx Rust crate for Hayabusa☆15Oct 8, 2026Updated 3 weeks ago
- ペネトレーションテストについて☆76Aug 12, 2021Updated 5 years ago
- This is a repository for reporting any issues in any of my software☆14Oct 23, 2026Updated 2 weeks ago
- Takajō (鷹匠) is a Hayabusa results analyzer.☆168Oct 25, 2026Updated last week
- ☆21May 8, 2022Updated 4 years ago
- FastIR Agent is a Windows service to execute FastIR Collector on demand☆14Apr 26, 2017Updated 9 years ago
- Rhaegal is a tool written in Python 3 used to scan Windows Event Logs for suspicious logs. Rhaegal uses custom rule format to detect sus…☆43Sep 21, 2023Updated 3 years ago
- Documentation and scripts to properly enable Windows event logs.☆725Oct 3, 2025Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- ☆25Oct 9, 2024Updated 2 years ago
- Bulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard☆20Updated this week
- Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.☆3,441Updated this week
- Windows Event Log "Microsoft-Windows-Partition%4Diagnostic.evtx" parser and devices' VSNs extractor.☆20Nov 28, 2023Updated 2 years ago
- This repository contains helper scripts and custom configs to get the best out of Google's Timesketch project.☆122Oct 8, 2023Updated 3 years ago
- Menu for Thor scanner lite☆20Oct 24, 2025Updated last year
- Incident response teams usually working on the offline data, collecting the evidence, then analyze the data☆48Jan 2, 2022Updated 4 years ago
- A DFIR Incident Response AI bot using local Ollama LLM to derrive automated findings from logs☆18Jan 17, 2026Updated 9 months ago
- Ghidra Script for automated analysis of EMOTET☆18Feb 3, 2021Updated 5 years ago
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.☆237Oct 27, 2026Updated last week
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆874Updated this week
- Install SANS SIFT Workstation on Ubuntu 22.04 ARM64 (Apple Silicon / UTM)☆10Apr 2, 2026Updated 7 months ago
- wip: SecHack365.☆10Apr 3, 2019Updated 7 years ago
- Scripts to integrate DFIR-IRIS, MISP and TimeSketch☆37Feb 2, 2022Updated 4 years ago
- macOS Artifact Intelligence Tool☆13Apr 30, 2019Updated 7 years ago
- Automated pipeline for generating forensic timelines from Magnet Response collections.☆15Nov 6, 2025Updated last year
- Security Camp 2021 & GCC 2022☆112May 24, 2022Updated 4 years ago
- CyberChef - Detection Engineering, TI, DFIR, Malware Analysis Edition☆66Jun 18, 2026Updated 4 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Rapid Large-Scale Hunting and Collection for Enterprise AD Networks☆10May 7, 2025Updated last year
- ☆16Updated this week
- geolocate ip addresses in IIS logs☆21Updated this week
- API hashing written in C to load APIs indirectly using CRC32 hashing☆15Jul 27, 2020Updated 6 years ago
- Self-hosted Speedtest for HTML5 and more. Easy setup, examples, configurable, mobile friendly. Supports PHP, Node, Multiple servers, and …☆12Feb 25, 2021Updated 5 years ago
- Get-MiniTimeline - Triage Collection and Timeline Generation w/ KAPE☆37May 25, 2024Updated 2 years ago
- Git for me to put all my forensics stuff☆23Sep 2, 2025Updated last year