fkie-cad/sandroid_dexray-interceptA Android malware analysis tool that creates comprehensive runtime profiles by hooking into application behavior across cryptography, file systems,…
githubsecuritylab/seclab-taskflows-fuzzingAn LLM-driven fuzzing pipeline powered by the GitHub Security Lab Taskflow Agent
prox0959/memguardZero-dependency Windows EDR utility that detects and mitigates unauthorized LSASS memory access, handle duplication, and LOLBin credential dumping in…
prox0959/cryptoclipguardReal-time Windows clipboard hijack detector that monitors clipboard changes, restores replaced BTC, ETH, SOL, and USDT addresses, and alerts users to…
notrequiem/antidbgA stealthy, fully syscalled C/C++ userland anti-debugging library for Windows, designed to protect software from reverse engineering
kaandemir993/purerat-msbuild.exe--c2-extraction--net-evasion-analysisReverse engineering analysis of PureRAT RAT abusing msbuild.exe, extracting C2 infrastructure, .NET evasion APIs, file system manipulation, and…
capesandbox/capesoloStandalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…
v-pun215/tourmalineReverse engineering notes, deobfuscated source, IOCs, and YARA rules for the Tourmaline ClickFix Python RAT, covering its DNS tunnel and blockchain…
voidsecsoftwares/voidsyscallCross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.
jithinkrishnanrs/stylesmuggler-ioc-toolkitStyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells,…
withsecurelabs/shadowhammerBatch-mode checker for Shadowhammer malware indicators, scanning local or provided MAC addresses against known malicious hashes, with offline support…
vasyapokemon/cve-2026-31431Research and detection toolkit for Linux kernel LPE CVE-2026-31431, including exploit analysis, YARA rules, auditd/Falco detection, patching guide,…
shahidmallaofficial/cpanel-cve-2026-41940-fixOne-shot detection and remediation for cPanel/WHM servers compromised via CVE-2026-41940, including IOC checks, malware cleanup, C2 blocking, and…
arkha-corvus/letsdefend-soc336-windows-ole-zero-click-rce-exploitation-detected-cve-2025-21298-We are expected to investigate a critical alert reporting a Windows OLE zero-click RCE exploitation (CVE-2025-21298) delivered via a malicious RTF…
tracebyte8/systraceLinux system-call monitor using ptrace to trace file, process, network, and memory activity, with namespace isolation and machine learning…
dinotools/dionaeaLow-interaction honeypot that emulates vulnerable network services to capture malware, shellcode, and exploit attempts, with IPv6 and TLS support.
mgreen27/detectraptorA repository to share publicly available Velociraptor detection content
0x0allenace/soc-analyst-portfolioA curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…
