GitHub stars · StarDay

1meirwah / awesome-incident-responseA curated list of tools for incident responseApache-2.0 · Permissive9,540

2toniblyx / my-arsenal-of-aws-security-toolsList of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.ShellApache-2.0 · Permissive9,531

3LOLBAS-Project / LOLBASLiving Off The Land Binaries And Scripts - (LOLBins and LOLScripts)XSLTGPL-3.0 · Share derivative source8,925

4zeek / zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.C++License not declared8,182

5cugu / awesome-forensics⭐️ A curated list of awesome forensic analysis tools and resourcesCC0-1.0 · Permissive5,240

6clong / DetectionLabAuthor description: Automate the creation of a lab environment complete with security tooling and logging best practicesHTMLMIT · Permissive5,056

7intelowlproject / IntelOwlIntelOwl: manage your Threat Intelligence at scalePythonAGPL-3.0 · Share derivative source4,803

8OTRF / ThreatHunter-PlaybookA community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.PythonMIT · Permissive4,709

9Neo23x0 / LokiLoki - Simple IOC and YARA ScannerPythonGPL-3.0 · Share derivative source3,801

10WithSecureOpenSource / chainsawRapidly Search and Hunt through Windows Forensic ArtefactsRustGPL-3.0 · Share derivative source3,708

11google / timesketchCollaborative forensic timeline analysisPythonApache-2.0 · Permissive3,446

12Yamato-Security / hayabusaHayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.RustAGPL-3.0 · Share derivative source3,442

13mikeroyal / Digital-Forensics-GuideDigital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.PythonLicense not declared3,220

14sbousseaden / EVTX-ATTACK-SAMPLESWindows Events Attack SamplesHTMLGPL-3.0 · Share derivative source2,642

15matanolabs / matanoOpen source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWSRustApache-2.0 · Permissive1,708

16diogo-fernan / ir-rescueA Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.BatchfileLicense not declared487

17helixmap / sigwoodLocal-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.PythonMIT · Permissive357

18codeyourweb / fastfinderIncident Response - Fast suspicious file finderGoLicense not declared260