Repository Index

Tools for the Computer Incident Response Team :computer:

• dfir
• python
• carbonblack
• malware-analysis

Python implementation of the Packed Executable iDentifier (PEiD)

• peid
• peid-signature
• pe-file
• pe-files

A Python library and command line tools to provide interactive log visualization.

• cybersecurity
• investigation
• malware-analysis
• malware-research

Minimal, consistent Python API for building integrations with malware sandboxes.

• sandbox
• malware-analysis
• api-client
• library

BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)

• malware-analysis
• reverse-engineering
• debugger
• malware

A modular Python application to pull intelligence about malicious files

• malware-analysis
• malware-research
• investigation
• cybersecurity

Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection

• docker-image
• executable-packing
• malware-packers
• research-platform

An ICAP Server with yara scanner for URL and content.

• python
• icap-server
• yara
• malware-analysis

HoneyHTTPD is a Python-based web server honeypot/service imitation builder. Great for honeypots or faking HTTP services.

• python
• honeypot
• honeypot-http
• python-web

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

• entropy
• pe-file
• pe-files
• pe-format

Dataset of packed PE samples

• dataset
• pe-files
• upx
• samples

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Cryptographic Dataset Generation & Modelling Framework

• cryptography
• deep-learning
• deep-neural-networks
• machine-learning

Packing detection tool for PE files

• detector
• pe-file
• pe-format
• peid

Dataset of packed ELF samples

• samples
• dataset
• upx
• malware-analysis

Attack tool for altering packed samples so that they evade static packing detection

• adversarial
• attack-defense
• evasion
• executable-packing

A modular Linux telemetry engine built with eBPF, libbpf CO-RE, and Modern C++ that captures kernel-level process, file, syscall, and network events through a portable event-processing pipeline for decoding, enrichment, filtering, and structured output—forming the foundation for higher-level runtime intelligence.

• cpp20
• ebpf
• event-logger
• filesystem

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

• binary-analysis
• entropy
• entrypoint
• executable-packing

A Single Library Parser to extract meta information,static analysis and detect macros within the files.

• malware-analysis
• pdf-parsing
• pe-executable
• office-files

A simple tool to organise large malicious/benign files into a organised Structure.

• malware
• malware-analysis
• malware-research
• clean-file

Simple tool to find the yara matches on a file

• yara
• yara-rules
• malware
• malware-analysis

Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.

• bpf
• ebpf
• forensics
• goroutine