Beast code in Giters

Martin Willing's starred repositories

zui

Zui is a powerful desktop application for exploring and working with data. The official front-end to the Zed lake.

Language:TypeScriptNOASSERTION1744 29 1010

cli

Official Command Line Interface for the IPinfo API (IP geolocation and other types of IP data)

Language:GoApache-2.01661 30 93

evtx

A Fast (and safe) parser for the Windows XML Event Log (EVTX) format

Language:RustApache-2.0609 22 49

aftermath

Aftermath is a free macOS IR framework

Language:SwiftMIT440 15 14

Microsoft-Extractor-Suite

A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.

Language:PowerShellGPL-2.0395 14 40

KnockKnock

Enumerate persistently installed software

Language:Objective-CGPL-3.0383 15 32

Trawler

PowerShell script to help Incident Responders discover potential adversary persistence mechanisms.

Language:PowerShellMIT295 2 11

Netiquette

Network Monitor

Language:Objective-CGPL-3.0291 14 14

MFT_Browser

$MFT directory tree reconstruction & FILE record info

Language:PowerShellMIT280 130

WhatsYourSign

WhatsYourSign adds a menu item to Finder.app. Simply right-, or control-click on any file to display its cryptographic signing information!

Language:Objective-CGPL-3.0267 23 21

TrueTree

A command line tool for pstree-like output on macOS with additional pid capturing capabilities

Language:SwiftNOASSERTION214 13 4

AuthLogParser

AuthLogParser is a powerful DFIR tool designed specifically for analyzing Linux authentication logs, commonly known as auth.log

Language:PowerShellMIT190 50

WindowsTimeline

Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)

Language:PowerShellMPL-2.0167 13 2

mft

A parser for the MFT (Master File Table) format

Language:RustApache-2.0117 10 16

OneNoteAnalyzer

A C# based tool for analysing malicious OneNote documents

Language:C#MIT107 8 2

TaskExplorer

Visually explore all running tasks (processes) ....viewing its signature status, loaded dylibs, open files, network connection, and much more.

Language:Objective-CGPL-3.078 7 3

brimcap

Convert pcap files into richly-typed ZNG summary logs (Zeek, Suricata, and more)

Language:GoBSD-3-Clause70 7 64

Evtx_Log_Browser

Evtx Log (xml) Browser

Language:PowerShellMIT55 70

WinEDB

Windows.EDB Browser

Language:PowerShellMIT49 40

Prefetch-Browser

Browse Windows Prefetch versions: 17,23,26,30v1/2 & some of SuperFetch .7db/.db's

Language:PowerShellMIT40 3 1

Jumplist-Browser

Automatic/Custom Destinations & LNK (MS-SHLLINK) Browser

Language:PowerShellGPL-2.026 20

aftermath

Aftermath is a free macOS incident response framework

Language:SwiftMIT24 10

zui-insiders

Releases for the Zui Insiders app.

NOASSERTION21 4 1

fmd

Windows file metadata / forensic tool.

Language:RustMIT14 4 8

macos-fseventsd

A library to parse macOS FsEvents

Language:RustMIT13 2 1

Invoke-SRUMDump

A pure PowerShell/ .NET DFIR capability that dumps the Windows SRUM (System Resource Usage Monitor) database to CSVs for analysis.

Language:PowerShell11 10

ESXiTri

ESXi Cyber Security Incident Response Script

Language:ShellGPL-3.01000

WINTri

Windows Cyber Security Incident Response Script

Language:PowerShellGPL-3.0400

PowerTriage

PowerTriage is a tool for SOCs and CERTs to captures a plethora of live data from remote computers

Language:PowerShellGPL-3.03 10

LINTri

Linux Cyber Security Incident Response Script

Language:ShellGPL-3.0200