libprocesshider
gianlucaborello/libprocesshiderLD_PRELOAD shared library that hides a Linux process from tools like ps and lsof by intercepting readdir and proc filesystem calls.
defensive-toolsinformation-gatheringmalware-analysis+4
1.1k
gianlucaborello/libprocesshiderLD_PRELOAD shared library that hides a Linux process from tools like ps and lsof by intercepting readdir and proc filesystem calls.
withsecurelabs/python-exe-unpackerA helper script for unpacking and decompiling EXEs compiled from python code.
sentinel-one/cobaltstrikeparserPython parser for extracting CobaltStrike Beacon configurations from PE files, memory dumps, and C2 URLs using heuristic XOR decryption and…
inquest/malware-samplesA collection of malware samples and relevant dissection information, most probably referenced from http://blog.inquest.net
rocky/python-decompile3Python decompiler for 3.7-3.8 Stripped down from uncompyle6 so we can refactor and start to fix up some long-standing problems
volexity/threat-intelSignatures and IoCs from public Volexity blog posts.
mohuihui/antispyAntiSpy is a free but powerful anti virus and rootkits toolkit.It offers you the ability with the highest privileges that can detect,analyze and…
curated-intel/ukraine-cyber-operationsCurated Intelligence is working with analysts from around the world to provide useful information to organisations in Ukraine looking for additional…
reveng007/darkwidowIndirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a…
mgeeky/threadstackspooferThread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners…
safedep/pmgPMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.
executemalware/malware-iocsCurated collection of indicators of compromise extracted from real-world malware investigations, including hashes, domains, and IPs for threat…
tyeurada/edrevasionworkshopWorkshop materials for “Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel” presented at DEF CON 34 and BSidesLV 2026. Covers…
doctorwebltd/malware-iocsCurated Indicators of Compromise (IOCs) from Doctor Web malware investigations, published for threat intelligence, detection engineering, and…
d4rksystem/vmwarecloakA PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis.
maddiestone/conpresentationsSlide decks from my conference presentations
d4rksystem/vboxcloakA PowerShell script that attempts to help malware analysts hide their Windows VirtualBox Windows VM's from malware that may be trying to evade…
fhightower/ioc-finderSimple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related…