dfirfpi

deployment-tools

This repo contains the code to build the .NET deployment tools and installers for all supported platforms, as well as the sources to .NET deployment tools.

bloodyAD

BloodyAD is an Active Directory Privilege Escalation Framework

ADFSDump

DonPAPI

Dumping DPAPI credz remotely

BlackLotus

BlackLotus UEFI Windows Bootkit

pwnable_writeup

An introduction course to system exploitation based on pwnable.kr challenges

PSPKIAudit

PowerShell toolkit for AD CS auditing based on the PSPKI toolkit.

PSPTool

Display, extract, and manipulate PSP firmware inside UEFI images

ADCSKiller

An ADCS Exploitation Automation Tool Weaponizing Certipy and Coercer

asm_book

A book teaching assembly language programming on the ARM 64 bit ISA. Along the way, good programming practices and insights into code development are offered which apply directly to higher level languages.

arm_asm_book

A book teaching assembly language programming on the ARM 64 bit ISA. Along the way, good programming practices and insights into code development are offered which apply directly to higher level languages.

moneta

Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs

necrobrowser

necromantic session control

RpcInvestigator

Exploring RPC interfaces on Windows

caretta

Instant K8s service dependency map, right to your Grafana.

Offensive_tools

Kubestroyer

Kubernetes exploitation tool

decoder

"secrets" decoding for FRITZ!OS devices

DFIRMindMaps

A repository of DFIR-related Mind Maps geared towards the visual learners!

RdpCacheStitcher

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

Zircolite

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

munin

Online hash checker for Virustotal and other services

systeminformer

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals.com

xways-forensics

Personal settings for X-Ways Forensics

DumpReparsePoints

This is a simple tool to dump all the reparse points on an NTFS volume.

speakeasy

Windows kernel and user mode emulation.

msldap

LDAP library for auditing MS AD

pypykatz

Mimikatz implementation in pure Python

ODIN

Automated network asset, email, and social media profile discovery and cataloguing.

AttackSurfaceAnalyzer

Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.