Test Blue Team detections without running any attack.

A Splunk Technology Add-on to forward filtered ETW events.

CDIR Analyzer - parsers for data collected by CDIR Collector

A C# (.NET 6) tool to compare the file signature of files recursively and inform the user of matches and mismatches

Rapid DFIR Triage Collection Tool For Windows, Mac and Linux

C# Library and research notes for Windows 11 Notepad State Files

An updated fork of @bacanoicua's RAMDumpExplorer project. This is a program designed to analyze a dump of the RAM memory to search for potentially malicious files. The program scans the dump file for specific patterns and uses regular expressions to identify and extract the matched values

An updated fork of @AbdulRhmanAlfaifi's EventLogMonitor, which hooks into Window Event Logs and displays the new events as they are written to disk.

Reverse Engineering the Tabstate files for Windows Notepad

An updated fork of @thereisnotime's xxUSBSentinel, a Windows anti-forensics USB monitoring tool.

An updated fork of @3lp4tr0n's BeaconHunter. Detect and respond to Cobalt Strike beacons using ETW

An updated fork of @woanware's WMI-Parser project

An updated fork of @Dijji's XstReader, which is an open-source viewer for Microsoft Outlook’s .OST and .PST files, written entirely in C#

An updated fork of @moaistory's WinSearchDBAnalyzer project

An updated fork of @vinaypamnani's wmie2 project

This repository serves as a place for community created SQLECmd Maps for use with SQLECmd.

An updated fork of @ignacioj's WMIParserStr project

An updated fork of @MTJailed's BinReveal project. This is a project for analyzing files to find signatures or hidden files in a file

Reverse Engineering the Windowstate files for Windows Notepad

PurpleSharpEnhanced is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments