Repository Index

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Samsung Tizen root

• embedded-linux
• firmware-analysis
• hardware-hacking
• mali-gpu

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

AVClass malware labeling tool

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

• malware-samples
• wscript
• deobfuscation
• angler

Audited & minimal JS implementation of Salsa20, ChaCha and AES

• aes-siv
• chacha20
• chacha20-poly1305
• chacha20poly1305

Share sensitive info without leaving a trace in your chat logs or email accounts.

Drltrace is a library calls tracer for Windows and Linux applications.

• dbi
• malware-analysis
• malware-detection
• api-trace

teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.

• ids
• teler
• waf
• teler-ids

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

A framework for automated extraction of static and dynamic features from Android applications

• android-malware-detection
• android-analysis

A Tool for Automatic Analysis of Malware Behavior

• machine-learning
• clustering
• classification
• malware-analysis

Auditable & minimal JS implementation of public-key post-quantum cryptography

• dilithium
• kyber
• ml-kem
• post-quantum-cryptography

A Python RESTful API framework for online malware analysis and threat intelligence services.

• python
• cybersecurity
• malware
• malware-analysis

Astral-PE is a low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64)

• cybersecurity
• hacktoberfest
• low-level
• mutator

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

• python
• malware-analysis
• automation
• config-dump

Android Malware Sandbox

Python telnet honeypot for catching botnet binaries

• honeypot
• telnet-server
• malware
• botnet

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

A collection of useful utility functions

• utility
• utilities
• string
• strings

Small portable Elliptic-Curve Diffie-Hellman in C

• elliptic-curve-diffie-hellman
• ecdh
• public-key-cryptography
• c

👤Minimalist Google OAuth Authentication for Elixir Apps. Tested, Documented & Maintained. Setup in 5 mins. 🚀

• elixir
• google
• google-api
• auth

A modular Python application to collect intelligence for malicious hosts.

• cybersecurity
• investigation