MalConfScan
jpcertcc/malconfscanVolatility plugin for extracts configuration data of known malware
digital-forensicsforensicsincident-response+3
498
jpcertcc/malconfscanVolatility plugin for extracts configuration data of known malware
xephora/threat-remediation-scriptsThis repository contains a list of new remediation scripts.
3lp4tr0n/beaconhunterDetect and respond to Cobalt Strike beacons using ETW.
malvuln/ransomlordRansomLord is a proof-of-concept Anti-Ransomware exploitation tool that automates the creation of PE files, used to compromise ransomware…
cronup/malware-iocsCollects and organizes malware indicators of compromise (IOCs) for rapid threat detection, incident response, and actionable intelligence sharing.
sandflysecurity/sandfly-entropyscanEntropy scanner for Linux to detect packed or encrypted binaries related to malware. Finds malicious files and Linux processes and gives output with…
threatlabz/iocsCurated Indicators of Compromise and YARA rules from Zscaler ThreatLabz public reports for threat hunting, malware research, and detection…
cristianzsh/amcache-evilhunterParse and analyze a Windows Amcache.hve registry hive, VirusTotal integration.
threatray/threat-researchIoCs and YARA rules from Threatray's Threat Research
mindcrypt/stegowiperA powerful and flexible tool to apply active attacks for disrupting stegomalware
0xtoxin/malware-iocsJust my findings of malwares
iocx-dev/iocxAn extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern…
nccgroup/mimikatz-detector-busylightUSB HID driver emulation with PID/VID (0x3bca/0x27bb) of Plenom A/S Busylight Alpha, that is supported by Mimikatz. When mimikatz is executed, a…
mukendi/kratosminifilterKratos is a high-performance Windows File System Minifilter driver designed to detect, block, and permanently immunize
synacktiv/metamorphA command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows (ETW) AutoLogger sessions.
ares-sys/uefi_bootkit_softlandingFirst public analysis of SoftLanding UEFI bootkit: Ring -2 implant, CVE-2025-7029, 240+ Gigabyte boards, GPU AI evasion, dual C2. YARA + Sigma +…
te0rwx/cve-2025-32433-detectionCustom YARA rule for detecting artifacts of CVE-2025-32433, an Erlang/OTP SSH pre-authentication RCE vulnerability. Validated against public PoCs and…
knight0x07/bibi-windows-wiper-analysisTechnical Analysis of Bibi-Windows Wiper Targeting Israeli Organizations