The pattern matching swiss knife
Repository Index
86,076 visible repositories in the index
1–24 of 41 · Most stars
Repository of yara rules
Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.
- malware
- virustotal
- malpedia
- urlhaus
Loki - Simple IOC and YARA Scanner
- python
- yara
- signature
- scanner
DIE engine
- signature
- reverse-engineering
- unpacker
- yara
YARA signature and IOC database for my scanners and tools
- signature
- yara-rules
- ioc
- scanner
:collision: A boilerplate application for building RESTful APIs Microservice in Node.js using express and mongoose in ES6 with code coverage and JsonWebToken Authentication
Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
- android
- antivirus
- machine-learning
- malware-detection
Security sensor for realtime threat detection and protection
All-in-One malware analysis tool.
- linux
- malware-analysis
- python3
- static-analysis
Indicators of Compromises (IOC) of our various investigations
- ioc
- malware
- yara
- misp
Protect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.
Living Off The Land Drivers
- drivers
- malicious
yarGen is a generator for YARA rules
- python
- yara
- malware
- malware-research
IDA pro plugin to find crypto constants (and more)
A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.
Multi-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring, quarantine, and multi-channel alerting
- bash
- clamav
- inotify
- intrusion-detection
Elastic Security detection content for Endpoint
BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.
- security
- yara
- serverless
- terraform
A static analyzer for PE executables.
- malware
- static
- analysis
- pe
Extract and aggregate threat intelligence.
- ioc
- indicators-of-compromise
- threatintel
- threat-intelligence
PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.
Modular file scanning/analysis framework
- python
- analytic-machines
- analysis-framework
- python-script
Defanged Indicator of Compromise (IOC) Extractor.
- ioc
- indicators-of-compromise
- library
- ioc-extractor