Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
- anti-analysis
- anti-debugging
- anti-sandbox
- anti-vm
Repository Index
47,133 repositories indexed
1–16 of 16 · Most stars
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
Remove duplicates from MASSIVE wordlist, without sorting it (for dictionary-based password cracking)
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
- forensics
- hypervisor
- memory-dump
- reverse-engineering
Enable root SSH on BMW MGU head units (iDrive 7 / ID8 BDC3 / ID8 BCP) over ENET - flash the debug image, enroll, persistent SSH with no B7F8E5 DTC, and a unique per-car key.
- developer-mode
- idrive
- idrive7
- root
Automated Tactics Techniques & Procedures
- empire
- tactics
- procedure
- cybersecurity
ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.
Threat Intelligence Quotient Test - Dataviz and Statistical Analysis of TI feeds
A tool for quantitative risk analysis of Android applications based on machine learning techniques
- android
- risk
- android-permissions
- quantitative-risk-analysis
YALIH (Yet Another Low Interaction Honeyclient) is a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques
HElib is an open-source software library that implements homomorphic encryption. It supports the BGV scheme with bootstrapping and the Approximate Number CKKS scheme. HElib also includes optimizations for efficient homomorphic evaluation, focusing on effective use of ciphertext packing techniques and on the Gentry-Halevi-Smart optimizations.
Liquid Auth Service
Real-time network traffic analysis in your terminal.
- cli
- ddos
- ddos-detection
- go
Helper to authenticate website's users by sending them unique code by email.