Find public projects in our local index, with related guides and tools from MetaCyberGuru. Your search is not sent to GitHub.
Explore topic collections for selection checklists and useful search examples.
265 matching repositories.
5,477 indexed in total. Latest successful discovery check: 2026-11-08 09:40:22 UTC.
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
candirudigital-securityforensicsincident-responseiocmispspywarestix
Source: GitHub repository metadata.
Awesome list of digital forensic tools
awesomeawesome-listdigital-forensicsforensic-analysisforensicsinvestigative-journalismmetadata
Source: GitHub repository metadata.
Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
incident-responsethreat-huntingwindows-eventlog
Source: GitHub repository metadata.
This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices
dfirediscoveryforensicsincident-responseios
Source: GitHub repository metadata.
Fast and efficient osquery management
detection-infrastructureendpoint-securityhost-instrumentationincident-responseinfrastructure-managementosquerysecurity
Source: GitHub repository metadata.
Convert a variety of log formats to CSV while enriching detected IPs with Geolocation, ASN, DNS, WhoIs, Shodan InternetDB and Threat Indicator matches.
concurrentdfirgeolocationincident-responselog-enrichlog-parserlog-parsinglog-process
Source: GitHub repository metadata.
PowerShell script designed to help Incident Responders collect forensic evidence from local and remote Windows devices.
dfirevidenceforensicsforensics-investigationsforensics-toolsincident-responseincident-response-toolingpowershell
Source: GitHub repository metadata.
PowerShell script helping Incident Responders discover potential adversary persistence mechanisms.
blue-teamdfirincident-responsemalwarepersistencepowershellwindows
Source: GitHub repository metadata.
Python script to decode common encoded PowerShell scripts
dfirforensic-analysisforensicsincident-responsepowershellsecuritysecurity-toolsshellcode
Source: GitHub repository metadata.
Cross-platform incident response and live forensic artifact collector with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.
bashciscoeventlog-analysiseventlogsforensicatorforensicsforensics-investigationsincident-response
Source: GitHub repository metadata.
Shodan Monitoring integration for TheHive.
golangincident-managementincident-responseincident-response-toolingsecuritysecurity-toolsshodanthehive
Source: GitHub repository metadata.
Open-source desktop workbench for digital forensic analysis. Inspect ZIP/TAR/7z/UFDR archives, raw disk images/EWF, and iTunes/Android backups. Parse and view ABX, SQLite, SEGB, (B)PLIST, REALM, Protobuf, MMKV, Logs, hex, JSON, XML, images, audio/video, PDF, and more — all in one GUI.
abxandroid-forensicsbplistdfirdigital-forensicsforensicsios-forensicsleveldb
Source: GitHub repository metadata.
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
blue-teamdetection-engineeringebpfedrendpoint-detectionendpoint-securityetwincident-response
Source: GitHub repository metadata.
Kage 影 is a Windows host DFIR triage console. Point it at a suspect machine, get everything back in one sealed chain: artefact collection, Sigma-correlated timeline, YARA verdicts, open sockets tied to processes, local accounts, disk root anomalies, logging blind spots, indicator reputation, and a calibrated risk score with the report behind it.
blue-teamdfirdigital-forensicsforensicsincient-responsepythonsecurity-toolssoc
Source: GitHub repository metadata.
A curated list of security card games.
application-securityawesomeawesome-listcard-gamecryptographyeducationeducational-gameincident-response
Source: GitHub repository metadata.
A cybersecurity game in Azure Data Explorer
blue-teamcyber-defensecybersecurityeducationincident-responsepythonthreat-intelligence
Source: GitHub repository metadata.
A python application designed to remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host.
digital-forensicslinuxmemory-dumpvolatility-profiles
Source: GitHub repository metadata.
The most comprehensive, step-by-step roadmap for breaking into defensive cybersecurity. From absolute zero to your first Blue Team role. Every skill, tool, certification, and resource you need. No experience required.
awesome-listbeginner-friendlybeginners-guideblue-teamcareercareer-developmentcybersecuritycybersecurity-certifications
Source: GitHub repository metadata.
Detecting ATT&CK techniques & tactics for Linux
blue-teamdefensive-securityincident-responselinux-huntingmitre-attackred-teamsecurity-operationsthreathunting
Source: GitHub repository metadata.
Threat Hunting & Incident Investigation with Osquery
cybersecuritydfirforensicsincident-responseosquerythreat-hunting
Source: GitHub repository metadata.
We collect selected public repository metadata through GitHub’s official API and store it on our server. This is not a complete index of GitHub. Categories come from discovery queries and topics; a “skills” or “plugins” result is not a verified installation format. We do not run or audit the projects listed here.
Check the original repository’s licence, installation instructions and maintenance history before using it. Stars do not establish security, and a recent push does not prove that a project works. GitHub may have newer information than our last indexed record.
Search is lexical, not an AI answer engine. Short words and spelling differences can affect matches. This site is independent of GitHub. Report a wrong category, stale result or removal request.