Kage 影 is a Windows host DFIR triage console. Point it at a suspect machine, get everything back in one sealed chain: artefact collection, Sigma-correlated timeline, YARA verdicts, open sockets tied to processes, local accounts, disk root anomalies, logging blind spots, indicator reputation, and a calibrated risk score with the report behind it.
☆30Oct 9, 2026Updated last week
Alternatives and similar repositories for Kage-DFIR-toolkit
Users that are interested in Kage-DFIR-toolkit are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Kumo 蜘蛛 is a domain OSINT & security reconnaissance framework. Drop a domain, get everything back in real time across 27 parallel module…☆70Oct 9, 2026Updated last week
- Box Of Hope is a C++ event driven platform to protect you during the COVID-19 pandemic. BOH uses NFC and WiFi technology to ensure your m…☆19Feb 1, 2023Updated 3 years ago
- Cognitive Artifact Intelligence Research Network☆67Updated this week
- Blacklight is a cross-platform toolkit for mapping, analyzing, and understanding the local AI agent attack surface across Windows, macOS,…☆88Updated this week
- LLM-driven generator for Mythic Agents, Payload-Type and C2 Profiles.☆55Aug 24, 2026Updated last month
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Flowwink is the next gen open source Business Operating System with 500+ skills where Hermes agents, Claude, OpenClaw or internal FlowPil…☆28Updated this week
- 1200+ AI models in your GitHub Copilot Chat — free & forever free. VS Code extension powered by OmniRoute: 340+ providers (90+ free) — Ki…☆131Sep 3, 2026Updated last month
- EntraTrace is a defensive security research tool for tracking and identifying the behavior of offensive tooling targeting Microsoft Entra…☆122Updated this week
- Links to malware-related YARA rules☆15Sep 29, 2022Updated 4 years ago
- Self-hosted operations app for teams running a portfolio of websites: projects, an encrypted credential vault, content work, people and m…☆68Aug 8, 2026Updated 2 months ago
- A defensive decompilation layer: Ghidra facts, lifted into runnable Python & artifacts aiding analysis.☆16Aug 7, 2026Updated 2 months ago
- Drift Corpus : repository of Windows Kernel patch diffs.☆28Jul 15, 2026Updated 3 months ago
- Generate malware traces for detection tests☆19Updated this week
- Local-first anti-detect browser workspace: isolated profiles, AI agents, visual automation, Record & Replay, proxies and team workflows. …☆59Updated this week
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Fast Windows post-exploitation wins after initial access.☆29Jan 28, 2026Updated 8 months ago
- ☆23Dec 15, 2022Updated 3 years ago
- Automated Malware Behavior Analysis Tool☆12May 13, 2026Updated 5 months ago
- Packet capture on remote fortigate via SSH using the "diagnose sniffer packet" command.☆11Apr 20, 2021Updated 5 years ago
- Self-hosted second brain and operating engine for human and AI workspaces: topology, source evidence, memory, retrieval, agents, tools, w…☆38Updated this week
- cve cve-2026-60206 weblogic saml exploit poc vulnerability oracle scanner security☆35Jul 24, 2026Updated 2 months ago
- ☆34Sep 17, 2026Updated last month
- ☆20Oct 23, 2020Updated 5 years ago
- How to Register your own AV with Defender☆37Aug 27, 2026Updated last month
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- All in one Design tool for EVERYONE☆27Oct 10, 2026Updated last week
- A Windows process injection loader combining PPID spoofing, manual DLL mapping, module stomping, and direct NT syscall☆38Sep 8, 2026Updated last month
- Linux Persistence Detection, Hunting and Artifact Collection script☆26Jul 20, 2026Updated 2 months ago
- Zero-config statusline for Claude Code (Desktop & CLI)☆56Updated this week
- Aether is a Windows memory-forensics and threat hunting tool that scans live process memory for malicious pattern, detect injection techn…☆66Jul 5, 2026Updated 3 months ago
- Write and run custom C kernels for Intel Core Ultra NPUs☆69Updated this week
- Generate professional, audit-ready documentation of your Microsoft Intune tenant in minutes. Sign in, pick what to document, export as PD…☆61Updated this week
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆108Oct 1, 2026Updated 2 weeks ago
- EvoX Genesis is an autonomous system for long-horizon software evolution that recursively builds, continues, and transforms complex softw…☆72Updated this week
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- This query identifies Microsoft-signed Binaries and Scripts that are not system initiated. This technique is commonly used in phishing at…☆10Sep 14, 2022Updated 4 years ago
- StewardOS - agentic autonomous OSS system☆74Oct 7, 2026Updated last week
- KeyHunter is a powerful tool designed to discover API key leaks from subdomains and archived URLs☆21Aug 1, 2026Updated 2 months ago
- Open-source, local-first AI coding agent usage and cost dashboard for Claude Code, Codex, Cursor, OpenCode, Kiro, and Pi.☆126Updated this week
- macOS Monterey for Dell XPS 15 9570☆11Jun 15, 2022Updated 4 years ago
- Hundred Days of Yara Challenge☆12Jun 21, 2022Updated 4 years ago
- PoC for WinNotify, demonstrated through a driver mapper, and local privilege escalation.☆40Sep 20, 2026Updated 3 weeks ago