Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.
Awesome Security lists for SOC/CERT/CTI
Beginner-friendly static malware triage: detect disguised, embedded and suspicious files (PDF, Office, archives) with a readable CLI.
A 135+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 332-tool MCP server — on one Cloudflare Workers deploy. MIT licensed. Portfolio: pranithjain.qzz.io
Detonate suspicious files and URLs using Model Context Protocol to retrieve normalized threat verdicts, IOCs, and malware intelligence.
Detect residual Windows artifacts and forensic data left behind by uninstalled software to ensure complete system cleanup.
Run bash commands natively on Windows with PsBash, transpiling bash to PowerShell for typed .NET output and bash-like results
Modern bilingual IT/EN honeypot and SOC analysis platform for attack monitoring, session correlation, threat intelligence, Suricata, MITRE ATT&CK, reporting and cybersecurity learning.
Enable fast and automated threat hunting using agent-based methods powered by Python and large language models on Kali Linux.
Provide a curated set of digital forensics and incident response tools for Linux, MacOS, memory, and mobile investigations.
An auto-updated summary of recently observed C2 infrastructure based on metadata from Internet Query Platforms. Updates daily.
Rust DFIR tool that massively parses cross-platform evidence, even deleted logs, into a lateral movement timeline and graph database.
🪓 Analyze logs swiftly for incident response, threat hunting, and forensic investigations with LogReaper's high-speed tools and flexible parsers.
🔍 Transform source code into actionable security insights with the Code-First Automated Threat Modeling Toolkit for deep risk analysis.
Static PE malware triage engine — imphash/entropy/packer/strings/capabilities/YARA + MITRE ATT&CK, weighted verdict. No sample execution, offline core.
🐕 Enhance code review and verification workflows for Python, Go, React, and AI frameworks. Boost your development process with seamless integration.
🌐 Discover cybersecurity conferences in 2026, easily contributing to a global list. Stay informed and connected in the ever-evolving cybersecurity landscape.
One command installs 670+ security tools on Debian/Ubuntu/Kali, Fedora, Arch, openSUSE and Termux. Its authorization-gated MCP server runs them in a disposable Kata Containers VM sandbox for Claude Code, Codex, Gemini CLI, OpenCode and other MCP clients. 872 agent skills for CTF, pentesting, bug bounty, DFIR and red/blue teams.
KQL-Queries 🐙 provides ready KQL scripts for Microsoft Defender XDR threat hunting, helping security teams detect, investigate, and respond to threats.
Threat-intel teardown + keyless live tracker of a multi-brand marketplace phishing-as-a-service (PhaaS) operation (Classiscam/Telekopye class) impersonating OLX, Subito, Kleinanzeigen & ~120 brands to steal card data + 3-D Secure/OTP. IOCs, kit analysis, detection signatures.
To associate your repository with the dfir topic, visit your repo's landing page and select "manage topics."