Repository Index

Repository of yara rules

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

Elastic Security detection content for Endpoint

Powerful Python tool to analyze PDF documents

Noriben - Portable, Simple, Malware Analysis Sandbox

PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

Incident Response - Fast suspicious file finder

• dfir
• investigation
• incident-response
• threat-hunting

Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant

ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.

• research
• anti-debug
• malware

Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.

simple YARA-based IOC scanner

• yara
• ioc
• security
• incident-response

Automatically exported from code.google.com/p/jsunpack-n

Python implementation of the Packed Executable iDentifier (PEiD)

• peid
• peid-signature
• pe-file
• pe-files

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

• linux
• security
• kernel
• rootkit

Ragpicker is a Plugin based malware crawler with pre-analysis and reporting functionalities. Use this tool if you are testing antivirus products, collecting malware for another analyzer/zoo.

The current repository contains all the scripts needed to build kernel-mode mac-a-mal malicious activity hooking on macOS.

• macos

YALIH (Yet Another Low Interaction Honeyclient) is a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Packing detection tool for PE files

• detector
• pe-file
• pe-format
• peid

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

• yara
• yara-scanner
• incident-response
• dfir

Detect the Shai Hulud 2.0 npm supply chain attack (796+ packages). Scans for malicious files, hashes, and compromised ecosystems. Fast, accurate scanner.

• cdn
• cve
• polyfill
• polyfill-io

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

• binary-analysis
• entropy
• entrypoint
• executable-packing