Python tool development project to help detect and synthesize the behavior of malicious code, especially fileless malware during the CA process.
-
Updated
Apr 16, 2024 - Python
#
artifact-collection
Here are 9 public repositories matching this topic...
Windows Forensic Triage Tool is a Python-based framework that automates forensic artifact collection, evidence analysis, digital signature verification, and HTML report generation to support incident response investigations.
-
Updated
Apr 12, 2026 - Python
A comprehensive PowerShell tool for security analysts and incident responders that systematically collects Windows event logs, system information, network data, and forensic artifacts into organized ZIP archives for security analysis and investigation.
windows security log-analysis powershell incident-response forensics cybersecurity threat-hunting digital-forensics security-tools event-logs artifact-collection
-
Updated
Apr 4, 2026 - PowerShell
macOS DFIR Artifact Collector — single-file, zero-dependency, modular collection script with selective module execution and supply-chain IOC sweeps.
macos bash incident-response forensics dfir threat-hunting triage blue-team supply-chain-security artifact-collection macos-forensics litellm artifact-collector
-
Updated
May 14, 2026 - Shell
Powerful investigation toolkit for deeper forensic analysis
powershell incident-response forensics dfir cybersecurity digital-forensics triage blueteam memory-forensics security-tools live-response windows-forensics memory-acquisition artifact-collection ir-toolkit incident-response-toolkit
-
Updated
Jan 21, 2026 - PowerShell
Single-file PowerShell Incident Response and DFIR triage collector for Windows. Gathers high-value forensic artifacts into one timestamped, hashed, packaged output. Defensive and authorized use only.
powershell incident-response dfir threat-hunting digital-forensics triage evtx live-response windows-forensics artifact-collection
-
Updated
Jul 6, 2026 - PowerShell
Read-only Windows forensic scanner for software traces persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks correlation. 20+ modules mapped to MITRE ATT&CK.
windows csharp dotnet persistence incident-response prefetch forensics dfir threat-hunting forensic-analysis blue-team mitre-attack artifact-collection shimcache
-
Updated
Jul 24, 2026 - C#
-
Updated
Nov 9, 2026 - Rust
A modular Windows DFIR artifact collection tool written in Go for incident response and response triage. Supports memory, NTFS, registry, event logs, and more.
-
Updated
Oct 28, 2026 - Go
Add this topic to your repo
To associate your repository with the artifact-collection topic, visit your repo's landing page and select "manage topics."