Tools

hydradragonantivirus/hydradragonav-mobile

Android Antivirus which doesn't require root, adb, ca install and cloud with many features and ways to detect more zero-day malware

gmh5225/antidebug-antivm

Different methods to detect a virtualized environment or potential debugging

gmh5225/antikerneldebug-poc

POC about how to detect windows kernel debug by pool tag.

zxgio/ghidra_stack_strings

A script to detect stack-strings by using emulation (leveraging Unicorn)

buzzer-re/shinigami

A dynamic unpacking tool

corelight/pingback

A Zeek package to detect the Pingback malware ICMP tunnel command and control (C2) network traffic.

corelight/redxor

Detection of Linux Malware C2 RedXOR - demonstration

corelight/zeek-xor-exe-plugin

Zeek plugin to detect and decrypt XOR-encrypted EXEs

bcoles/rootkit-signal-hunter

Detect Linux rootkits which use signals to elevate process privileges.

andrewaeva/dga

The repository that contains the algorithms for generating domain names, dictionaries of malicious domain names. Developed to research the…

r3mrum/loki-parse

A python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security…

paspke/scavenger_scanner

Detect CVE-2025-54313 eslint-config-prettier supply chain attack IOCs on Windows

qi-scape/scan-shai-hulud

Detect CVE-2026-45321 Mini Shai-Hulud supply chain compromise — scans for 170 npm + 2 PyPI poisoned packages across TanStack, Mistral AI, UiPath,…

respondiq/jsp-webshell-scanner

🔍 A simple Bash script to detect malicious JSP webshells, including those used in exploits of SAP NetWeaver CVE-2025-31324.

tadash10/detect-cve-2024-0762

Detecting vulnerabilities like CVE-2024-0762, particularly in UEFI firmware, is quite challenging due to the low-level nature

rapticore/orenpmguard

Defense Against the Shai-Hulud Supply Chain Attack

jnschaeffer/cve-2022-44268-detector

Detect images that likely exploit CVE-2022-44268