Kage 影 is a Windows host DFIR triage console. Point it at a suspect machine, get everything back in one sealed chain: artefact collection, Sigma-correlated timeline, YARA verdicts, open sockets tied to processes, local accounts, disk root anomalies, logging blind spots, indicator reputation, and a calibrated risk score with the report behind it.
☆45Oct 9, 2026Updated last month
Alternatives and similar repositories for Kage-DFIR-toolkit
Users that are interested in Kage-DFIR-toolkit are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆18Jan 5, 2026Updated 10 months ago
- csint tool username | dark sherlock 1.1☆54Oct 27, 2026Updated 2 weeks ago
- Open source browser lab to build a simulated infrastructure, watch an attack move through it, and check whether your defense works.☆47Updated this week
- Open-source unified security operations & threat intelligence platform for OT/ICS environments with ontology-driven dashboards☆49May 27, 2026Updated 5 months ago
- SigLens is a Windows binary analysis tool designed to pinpoint the exact regions responsible for antivirus detections. It narrows detecti…☆44Oct 29, 2026Updated last week
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- 32 production-quality KQL detection rules for Microsoft Sentinel, mapped to MITRE ATT&CK for Cloud, credential access, lateral movement, …☆15Aug 1, 2026Updated 3 months ago
- A series of python scripts to extract information from Dark Web Applications☆14Mar 26, 2025Updated last year
- ⚡ Rust-accelerated temporal graph engine for cybersecurity threat hunting. Ingests 100M+ edges from PCAP/CSV on a single machine. Sub-sec…☆15Jul 30, 2026Updated 3 months ago
- Windows anti-forensics module☆27Jul 27, 2026Updated 3 months ago
- Bounded-state streaming scanner for web, source, and file content pipelines☆10Jun 19, 2026Updated 4 months ago
- ☆14Jun 4, 2026Updated 5 months ago
- PowerShell reverse-shell payload generator engineered to bypass Windows Defender and AMSI.☆26Aug 5, 2026Updated 3 months ago
- EntraTrace is a defensive security research tool for tracking and identifying the behavior of offensive tooling targeting Microsoft Entra…☆122Updated this week
- Links to malware-related YARA rules☆15Sep 29, 2022Updated 4 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Security content lifecycle management for Microsoft Sentinel and Microsoft Defender XDR.☆17Oct 18, 2026Updated 3 weeks ago
- Open-source Windows credential audit tool — extracts NTLM hashes from SAM/SYSTEM hives, cracks passwords using Hashcat, and tests passwor…☆18Mar 8, 2026Updated 8 months ago
- USN Journal full path builder☆71Apr 16, 2026Updated 6 months ago
- Argus — Local-first OSINT framework. 13 modules, 100% open source, zero API keys. AI chaining via Ollama. MCP server for Hermes/Claude Co…☆21Sep 29, 2026Updated last month
- A tool for checking if MFA is enabled on multiple Microsoft Services☆12Apr 5, 2026Updated 7 months ago
- THOR APT Scanner User Manual☆23Updated this week
- Scripts and tools created for appx analysis talk (Magnet summit 2019)☆19Feb 26, 2024Updated 2 years ago
- A local, open source character designer that runs on your own ComfyUI.☆16Updated this week
- Generate malware traces for detection tests☆21Updated this week
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- ☆51Apr 4, 2026Updated 7 months ago
- Live terminal artifacts☆11Aug 20, 2026Updated 2 months ago
- A series of python scripts to extract information from SQLite Data Files☆23Nov 15, 2025Updated 11 months ago
- Sophos Central PowerShell module☆12Jul 11, 2023Updated 3 years ago
- Self-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineer…☆60Oct 15, 2026Updated 3 weeks ago
- Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, c…☆36Aug 18, 2026Updated 2 months ago
- Packet capture on remote fortigate via SSH using the "diagnose sniffer packet" command.☆11Apr 20, 2021Updated 5 years ago
- ☆24Dec 15, 2022Updated 3 years ago
- LuaN1ao (鸾鸟) is an autonomous penetration testing agent based on state awareness and causal reasoning.☆10Dec 13, 2025Updated 10 months ago
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- Native Windows terminal multiplexer in Rust — persistent sessions, a native GUI, embeddable & driveable browser panes, and AI sub-agent o…☆18Jul 28, 2026Updated 3 months ago
- ☆12Aug 9, 2026Updated 3 months ago
- ☆15Mar 19, 2026Updated 7 months ago
- Nessus PRO Installation Guide with Latest Plugin Set [NO CRACK NEEDED] [UPDATED 2024]☆10Mar 22, 2024Updated 2 years ago
- DeepProbe - Memory Forensics Framework☆16May 16, 2026Updated 5 months ago
- App Trust Preview is a Mac app that helps you inspect apps, installers, disk images, executables, and scripts before opening them. It tur…☆12Aug 31, 2026Updated 2 months ago
- iOS Syscall Explorer for IDA 9.X☆15May 26, 2026Updated 5 months ago
Are these results useful?