Tools

dovughs/velum-vmm

Windows x64 research hypervisor using Intel VT-x and per-CPU EPT hooks to intercept Nt/Ex/Mm routines, apply request policies, and stream live kernel…

neo23x0/process-watcher

A process monitoring tool that tries to detect exploitation

didierstevens/didierstevenssuite

Collection of Python scripts for malware analysis, file format parsing, hashing, and forensic triage, including PDF, OLE, and XOR analysis utilities.

tandasat/minivisorpkg

The research UEFI hypervisor that supports booting an operating system.

darthton/hyperbone

Minimalistic VT-x hypervisor for Windows x64 providing syscall, MSR, IDT, and kernel inline hooks plus EPT-based page substitution and TLB splitting.

ionescu007/simplevisor

Minimal Intel VT-x hypervisor for Windows and UEFI that virtualizes a live host for introspection, supporting dynamic hyperjacking, unhyperjacking,…

not-matthias/amd_hypervisor

Rust AMD SVM hypervisor framework with customizable vmexit handlers (MSR, CPUID, RDTSC) and NPT hooking for kernel-level monitoring and research.

opposum0112/cusimanse

Composable research-contract and YAML-recipe framework for agent-operated security experiments on disposable compute

opposum0112/decretum

Contract LinkML compiler for a security researchers

hasamba/dfir-companion

DFIR forensics companion server + capture extension

atomdrift-project/scan

0-day malware detection for binaries, source & scripts (that doesn't suck)

zjuwyh/shadowmem

Defensive framework that maintains a safety-focused shadow memory to detect and block prompt-injection and long-horizon threats against LLM agents…

withsecurelabs/amsidetection

Proof-of-concept tool for detecting AMSI (Antimalware Scan Interface) bypasses and malicious in-memory script activity on Windows endpoints.

recofu/cve-2026-31431-copy-fail

Local privilege escalation exploit for CVE-2026-31431 in the Linux kernel crypto subsystem, providing root access and container breakout with a…

makitos666/cve-2026-31431-copy-fail-detection-toolkit

Detection and analysis toolkit for CVE-2026-31431 Linux LPE, providing Python and PowerShell scanners, YARA rules, and forensic analysis for active…

cert-ee/cuckoo3

Open-source automated malware analysis sandbox that runs suspicious files and URLs in isolated VMs and generates detailed behavioral reports.

mandiant/stringsifter

A machine learning tool that ranks strings based on their relevance for malware analysis.