yara-x
virustotal/yara-xRust-based pattern matching engine for malware researchers. Create YARA rules with textual/binary patterns, wildcards, and regex to identify and…
binary-analysisdata-recoverydefensive-tools+14
1.3k
virustotal/yara-xRust-based pattern matching engine for malware researchers. Create YARA rules with textual/binary patterns, wildcards, and regex to identify and…
d35ha/callobfuscatorObfuscate specific windows apis with different apis
pandaadir05/ghostDetects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process…
mrt4ntr4/ntwardenInspect live Windows system internals: processes, services, network, kernel callbacks, SSDT, and per-process anomalies; detect hooks and rootkits…
helixo32/crimsonedrSimulate the behavior of AV/EDR for malware development training.
3lp4tr0n/beaconhunterDetect and respond to Cobalt Strike beacons using ETW.
alphadelta/secure-desktopAnti-keylogger/anti-rat application for Windows
c3rb3ru5d3d53c/mwcfgA Feature Rich Modular Malware Configuration Extraction Utility for MalDuck
ofriouzan/hardeningmeterHardeningMeter is an open-source Python tool carefully designed to comprehensively assess the security hardening of binaries and systems.
bi8d0/driversentinelDriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them against the…
adem-hosni/mappedimagesdetectorLightweight native Windows memory scanner for AV/EDR platforms, detecting suspicious mapped images and manual DLL injection techniques by IAT thunk
optiv/mangleMangle is a tool that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRs
rasta-mouse/threatcheckIdentifies the bytes that Microsoft Defender / AMSI Consumer flags on.
icyguider/nimcrypt2.NET, PE, & Raw Shellcode Packer/Loader Written in Nim
cerbersec/aresProject Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique
kubearmor/kubearmorRuntime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (LSM-BPF,…
nuclearphoenixx/fake-sandbox👁🗨 This script will simulate fake processes of analysis sandbox/VM software that some malware will try to avoid.
sap/macos-enterprise-privilegesTemporary macOS admin rights management tool for enterprise environments. Grants time-limited administrator privileges on-demand, enhancing security…