Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Forensics artefact collection tool for systems running Microsoft Windows

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

An Incident Response tool to extract console command history and screen output buffer

Windows Administrator level Implant.

Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.

A repository to share contributions related to TheHive Project

Source code for the blog post "Ransomware in the honeypot: how we capture keys with sticky canary files"

A 'raw' file copy tool for Windows systems -- bypassing the file mutex