
process-watcher
A process monitoring tool that tries to detect exploitation

A process monitoring tool that tries to detect exploitation

A Android malware analysis tool that creates comprehensive runtime profiles by hooking into application behavior across cryptography, file systems,…

Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.

A collection of Tools and Rules for decoding Brute Ratel C4 badgers

Small tool to play with IOCs caused by Imageload events

Windows Analysis and Research Toolkit

Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research

A Zeek package to detect the Pingback malware ICMP tunnel command and control (C2) network traffic.

A command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows (ETW) AutoLogger sessions.



Botnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open…

A python2 script for processing a PCAP file to decrypt C2 traffic sent to DOUBLEPULSAR implant

FWT is a security analysis and file monitoring tool that utilizes Sysmon events.

An API hooking framework for intercepting and monitoring Windows applications

Tool that gathers a customizable set of ETW telemetry and generates user-defined detections

Tool for solving BPF filters and crafting packets based on these.

AI-powered Windows diagnostic & auto-repair tool using Google Gemini. Detect crashes, optimize performance, scan for malware, and generate PowerShell…