dfirfpi

dpapilab

Windows DPAPI laboratory

decwindbx

A sort of a toolkit to decrypt Dropbox Windows DBX files

lsadecryptxp

LSASS LsaEncryptMemory(..decrypt..) for NT 5.1 and 5.2

wbin_installer

Personal scripts to setup dfir tools on fedora

Bad-Pdf

Steal Net-NTLM Hash using Bad-PDF

HackInBo

Unofficial Collection of Slides and Programs of HackInBo

decoder

"secrets" decoding for FRITZ!OS devices

EVTX-ATTACK-SAMPLES

Windows Events Attack Samples

Hob0Rules

Password cracking rules for Hashcat based on statistics and industry patterns

munin

Online hash checker for Virustotal and other services

mvtu

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Pentest-Tools

PrivescCheck

Privilege Escalation Enumeration Script for Windows

r0ak

r0ak ("roak") is the Ring 0 Army Knife -- A Command Line Utility To Read/Write/Execute Ring Zero on for Windows 10 Systems

win-exec-calc-shellcode

A small, null-free Windows shellcode that executes calc.exe (x86/x64, all OS/SPs)

WindowsRpcClients

This respository is a collection of C# class libraries which implement RPC clients for various versions of the Windows Operating System from 7 to Windows 10.

Zircolite

A standalone SIGMA-based detection tool for EVTX.

awesome-windows-kernel-security-development

windows kernel security development

etl-parser-ng

Event Trace Log file parser in pure Python

ipc-research

Inter-Process Communication Mechanisms

MemLabs

Educational, CTF-styled labs for individuals interested in Memory Forensics