capa
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
ai-assisted-reversingbinary-analysiscode-analysis+10
6.2k
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
alexandreborges/malwoverviewMulti-engine threat hunting tool for triaging malware samples, URLs, IPs, and IOCs across 20+ services including VirusTotal, Hybrid Analysis, and…
virustotal/yara-xRust-based pattern matching engine for malware researchers. Create YARA rules with textual/binary patterns, wildcards, and regex to identify and…
malpedia/malpedia-flossedFLARE floss applied to all unpacked+dumped samples in Malpedia, pre-processed for further use.
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
emalderson/thephishAutomated phishing email analysis tool integrating TheHive, Cortex, and MISP to extract observables, run analyzers, calculate verdicts, and notify…
capacitorset/box-jsA tool for studying JavaScript malware.
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
misp/misp-taxonomiesTaxonomies used in MISP taxonomy system and can be used by other information sharing tool.
forrest-orr/monetaLive usermode Windows memory analysis tool that detects malware IOCs by scanning process memory regions, filtering false positives, and dumping…
abhinavbom/threat-intelligence-hunterCLI tool to search, aggregate, and store IOCs from multiple open security feeds and APIs, enabling local threat intelligence database creation and…
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
concinnity-risks/ransomcoinpublicA DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries.
inquest/python-inquestlabsA Pythonic interface and command line tool for interacting with the InQuest Labs API.
onapsis/onapsis-mandiant-cve-2025-31324-vuln-compromise-assessmentSAP NetWeaver vulnerability and compromise assessment tool that detects CVE-2025-31324/42999, scans for IOCs, analyzes HTTP access and Java trace…
ry-allan/tanstack-compromise-checkerDetects CVE-2026-45321 (TanStack supply chain compromise) and Mini Shai-Hulud worm artifacts. Scans node_modules, lockfiles, persistence hooks…
cyberdudebivash/cyberdudebivash-cisco-asyncos-cve-2025-20393-scannerThis tool helps identify exposure to CVE-2025-20393 by checking for open TCP/6025 ports, responsive Spam Quarantine interfaces, and known…
