
http-stalling-detector
Detect HTTP stalling attacks like slowloris with Bro

Detect HTTP stalling attacks like slowloris with Bro

The Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent to or from…

A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection

Zeek plugin to detect and decrypt XOR-encrypted EXEs

Runtime application self-protection engine that hooks into application servers to monitor and block malicious database queries, file operations, and…

The AI Security Verification Standard (AISVS) focuses on providing developers, architects, and security professionals with a structured checklist to…

The StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides…

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Ability to detect suspicious activity such as (WEP/WPA/WPS) attack by sniffing the air for wireless packets.

Enumerate various traits from Windows processes as an aid to threat hunting

eBPF-based Linux rootkit detector using multi-channel cross-view analysis (sched_switch, NMI, /proc) to detect DKOM, tracepoint tampering, and…

ETW based POC to identify direct and indirect syscalls

A canary designed to minimize the impact from certain Ransomware actors

This tool parses log data and allows to define analysis pipelines for anomaly detection. It was designed to run the analysis with limited resources…

ML-assisted forensic analysis tool that automates memory, disk, and live system triage on Windows using Volatility 3, autorunsc, and sigcheck to…

Small tool to play with IOCs caused by Imageload events

Zeek package for tracking long connections to report them before they have completed.

Research related to the Power Tracks discovered in market microstructure.