Main Sigma Rule Repository

The FLARE team's open-source tool to identify capabilities in executable files.

JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

Volatility 3.0 development

This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots.

The SOC Analysts all-in-one CLI tool to automate and speed up workflow.

Extract and Visualize Data from URLs using Unfurl

Android Logs Events And Protobuf Parser

A python script developed to process Windows memory images based on triage type.

An open standard for hashing network flows into identifiers, a.k.a "Community IDs".

Script to perform bulk local GeoIP lookups (ASN and geo) for IP addresses

A python script to shift the timestamp on syslog data. Useful for forensicators combating time skew.

Binary Toolkit for the Carbon Black Cloud

Carbon Black ThreatHunter / VMware Carbon Black Enterprise EDR

Automatically exported from code.google.com/p/l2t-tools

This is an integration with Proofpoint's TRAP product and VMware Carbon Black Cloud.