AMSIDetection
withsecurelabs/amsidetectionProof-of-concept tool for detecting AMSI (Antimalware Scan Interface) bypasses and malicious in-memory script activity on Windows endpoints.
defensive-toolsdynamic-analysis-sandboxingmalware-analysis+1
withsecurelabs/amsidetectionProof-of-concept tool for detecting AMSI (Antimalware Scan Interface) bypasses and malicious in-memory script activity on Windows endpoints.
mindcrypt/covertchannels-steganographyA list of covert channels and steganography/steganalysis resources (books, papers & tools)
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
gmh5225/antikerneldebug-pocPOC about how to detect windows kernel debug by pool tag.
neo23x0/yara-performance-guidelinesA guide on how to write fast and memory friendly YARA rules
frank2/packer-tutorialA tutorial on how to write a packer for Windows!
corelight/redxorDetection of Linux Malware C2 RedXOR - demonstration
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
mushorg/buttinskyBotnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open…
pandipanda69/my-little-honeypotLightweight telnet honeypot for capturing IoT malware samples and identifying active command-and-control infrastructure, designed for educational…
meisterlos/cve-2025-51726PoC demonstrating SHA-1 code signing forgery and missing High Entropy ASLR in CyberGhostVPN installer, enabling trust bypass and predictable memory…
nccgroup/cve-2017-8759NCC Group's analysis and exploitation of CVE-2017-8759 along with further refinements
mrk336/from-eternalblue-to-cve-2025-2776-the-evolution-of-an-smb-attackIt shook the world in 2017 and has evolved into today’s CVE‑2025‑2776. Microsoft still relies on SMBv1, this article will explain how attackers have…
d7ead/mkpivmGenerate polymorphic, position-independent virtual machines (PIVMs) from arbitrary x86/x64 shellcode.
quinnbast/malicious-mcpA Proof-of-concept repository showing how an untrusted MCP server can steal literally everything...
saeidshirazi/awesome-android-securityA curated list of Android Security materials and resources For Pentesters and Bug Hunters
malienist/lupoWinDbg plugin for automated malware dynamic analysis and IOC extraction. Executes within the debugger to collect predefined indicators and writes…
soheiltnt/jakeyloggerPython-based keylogger for capturing and logging keystrokes. Designed for educational security research and testing.