enomothem/Whoamifuck

Rapidly Search and Hunt through Linux Forensics Artifacts

Sysmon for Linux

Linux Runtime Security and Forensics using eBPF

Threat-hunting tool for Linux

Post-exploitation and evasion research toolkit for Linux.

Cross-platform incident response and live forensics toolkit with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.

GRR Rapid Response: remote live forensics for incident response

A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts

UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.