james-baud

DFIR

Digital Forensics and Incident Response

osxcollector

A forensic evidence collection & analysis toolkit for OS X

rekall

Rekall Memory Forensic Framework

credmgr

Securely manage privileged account credentials via Shamir secret sharing

docker-forensics

Incident response environment

Empire

Empire is a pure PowerShell post-exploitation agent.

flare-wmi

go-audit

go-audit is an alternative to the auditd daemon that ships with many distros

grr

GRR Rapid Response: remote live forensics for incident response

gryffin

Gryffin is a large scale web security scanning platform

HELK

The Hunting ELK

Kansa

A Powershell incident response framework

laikaboss

Laika BOSS: Object Scanning System

metasploit-framework

Metasploit Framework

osquery

SQL powered operating system instrumentation, monitoring, and analytics.

plaso

Home of the super timeline

PowerShellArsenal

A PowerShell Module Dedicated to Reverse Engineering

protofuzz

Google Protocol Buffers message generator

pupy

Pupy is a remote administration tool with an embeded Python interpreter, allowing its modules to load python packages from memory and transparently access remote python objects. The payload is a reflective DLL and leaves no trace on disk

security_monkey

Security Monkey

synfulknock

WMIEventing

A PowerShell module to abstract the complexities of Permanent WMI Event Subscriptions

WMIne