Tools

zypherion-technologies/nemesis

.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.

adibirzu/openclaw-security-monitor

Proactive security monitoring for OpenClaw deployments. Detects ClawHavoc, AMOS stealer, CVE-2026-25253, memory poisoning, and supply chain attacks.

buter-chkalova/project-rvbbit

Educational Linux kernel rootkit PoC exploring DKOM, syscall hooking, stealth, observability and defensive detection

hullabrian/eventhorizon

Tool that gathers a customizable set of ETW telemetry and generates user-defined detections

c3rb3ru5d3d53c/signatures

Community Detection Signature Build and Distribution Pipeline for YARA, Suricata, Snort and Sigma

0rshemesh/jadx-magic-strings

JADX plugin that extracts method names, class references, and source file paths from string constants found in DEX files and decompiled Android code.

professorquantumuniverse/veto

Open-source Android client for VirusTotal. Scan files, URLs, and installed apps against 70+ antivirus engines. View detailed reports with hashes,…

hydradragonantivirus/hydradragonav-mobile

Android Antivirus which doesn't require root, adb, ca install and cloud with many features and ways to detect more zero-day malware

yarox24/attack_monitor

Endpoint detection & Malware analysis software

embee-research/yara-detection-rules

Yara Rules for Modern Malware

kavan00/android-projector-c2-malware

Breakdown of a c2-network of chinese beamers - SilentSDK-Analysis

hluwa/frida-dexdump

A frida tool to dump dex in memory to support security engineers analyzing malware.

cyb3rmx/qu1cksc0pe

All-in-One malware analysis tool.

ch0pin/medusa

Mobile Edge-Dynamic Unified Security Analysis

toborrm9/malicious_extension_sentry

Malicious Extension Database

an0nud4y/av-edr-lab-environment-setup

AV/EDR Lab environment setup references to help in Malware development

joesecurity/sigma-rules

Sigma rules from Joe Security