certgraveyard_yara
tjnel/certgraveyard_yaraAutomated YARA rule generation from the Cert Central compromised certificate database.
binary-analysisdefensive-toolsforensics+2
15
tjnel/certgraveyard_yaraAutomated YARA rule generation from the Cert Central compromised certificate database.
struppigel/portexanalyzerguiGraphical interface for PortEx, a Portable Executable and Malware Analysis Library
dwexi/entropystripAlgorithmic PE de-obfuscator, Shannon entropy radar, and incident triage engine
fox-it/dissect.cobaltstrikePython library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles
hasherezade/pe-bearPortable Executable reversing tool with a friendly GUI
struppigel/portexJava library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
erocarrera/pefilepefile is a Python module to read and work with PE (Portable Executable) files
libyal/libfwsiLibrary to access the Windows Shell Item format
glmcdona/process-dumpWindows tool for dumping malware PE files from memory back to disk for analysis.
rhacknarok/hacksguardA blazingly fast, multi-threaded TUI malware analysis tool built in Rust. Features deep PE parsing, YARA scanning, and heuristic risk scoring.
iocx-dev/iocxAn extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern…
dimareverse/nuitka-static-unpackerStatic-first research tool for unpacking Nuitka-compiled binaries: extracts constants, modules, recovers .pyc files, and generates analysis reports.
m10ust/machscopemacOS IPC, launchd, Mach-O, and trust relationship explorer — zero-dependency terminal-native forensic tool
pandaadir05/ghostDetects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process…
uky007/petriagePETriage: A symbol-unified PE file reader for triage, built for multi-platform and multi-interface use.
warpedatom/offsetinspectPowerShell toolkit for AMSI/Defender detection-boundary analysis and static malware triage maps byte offsets to detection triggers, plus YARA,…
zypherion-technologies/hallwatchUsermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.