stark4n6

KQL-threat-hunting-queries

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

DeepSound

Official DeepSound repository migrated from jpinsoft.net. DeepSound is a freeware steganography tool and audio converter that hides secret data into audio files. The application also enables you to extract secret files directly from audio files or audio CD tracks.

horus

An OSINT / digital forensics tool built in Python (formerly 'Sentinel')

MFTAnalyzer

This tool is meant to parse an NTFS $MFT file.

FLARE-VM-configs

These FLARE-VM configuration files are designed to be help setup a purpose-built installation, remove unnecessary packages to help streamline the installation.

otpauth

Google Authenticator migration decoder

MasterParser

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

usnjrnl_rewind

USN Journal full path builder

Microsoft-Analyzer-Suite

A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID

airdropmsisdn

Attempts to reverse a given partial hash to a phone number (or email) given the area code. Written for python3.

Kape4MDE

This script gives you a one stop shop for performing forensic acquisitions using KAPE via the MDE Live Response console

malware-tools

A list of useful tools for Malware Analysis (will be updated regularly)

pymobiledevice3

Pure python3 implementation for working with iDevices (iPhone, etc...).

UFADE

Extract files from iOS devices on Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and "advanced logical backups"

Scripts

macosac

Forensic Artifact Collection Tool for macOS

Nuitka

Nuitka is a Python compiler written in Python. It's fully compatible with Python 2.6, 2.7, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, and 3.11. You feed it your Python app, it does a lot of clever things, and spits out an executable or extension module.

chepy

Chepy is a python lib/cli equivalent of the awesome CyberChef tool.

jekyll-theme-chirpy

A minimal, responsive, and feature-rich Jekyll theme for technical writing.

dtformats

Collection of data formats

ccl-segb

Module(s) related to reading SEGB (fka "Biome") data from iOS, mascOS, etc.

protobuf-inspector

🕵️ Tool to reverse-engineer Protocol Buffers with unknown definition

UnifiedLogReader

A parser for Unified logging tracev3 files

DFIR-Regular-Expressions

Regular Expressions List used in Digital Forensic Tasks

magika

Detect file content types with deep learning

PySimpleGUI-4-foss

Mirror of the last GPL version of PySimpleGUI repository

Registry-Write-Block

Short scripts which use the registry to enable or disable write-blocking for removable disks

ExplorerPatcher

This project aims to enhance the working environment on Windows

Magnet-RESPONSE-PowerShell

PowerShell scripts for running Magnet RESPONSE forensic collection tool in large enterprises.

firefox-data-store-docs

Repo containing documentation regarding Firefox data stores across all platforms