Repository Index

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

• pe-format
• hooking
• pe-dumper
• pe-analyzer

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

• pe-sieve
• anti-malware
• malware-analysis
• malware-detection

Scan files or process memory for CobaltStrike beacons and parse their configuration

Process HTTP Pcaps With YARA

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang