WithSecure Labs

Popular repositories Loading

1. chainsaw chainsawPublic

   Rapidly Search and Hunt through Windows Forensic Artefacts

   Rust 3.6k 301

2. doublepulsar-detection-script doublepulsar-detection-scriptPublic

   A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

   Python 1k 309

3. python-exe-unpacker python-exe-unpackerPublic

   A helper script for unpacking and decompiling EXEs compiled from python code.

   Python 1k 351

4. CallStackSpoofer CallStackSpooferPublic

   A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)

   C++ 591 74

5. Kanvas KanvasPublic

   A simple-to-use IR (incident response) case management tool for tracking and documenting investigations.

   Python 459 71

6. LinuxCatScale LinuxCatScalePublic

   Incident Response collection and processing scripts with automated reporting scripts

   Shell 338 60