Tools

360netlab/dga

Suspicious DGA from PDNS and Sandbox.

urule99/jsunpack-n

Automatically exported from code.google.com/p/jsunpack-n

joesecurity/sigma-rules

Sigma rules from Joe Security

claroty/arya

Generates pseudo-malicious files from YARA rules to trigger AV/EDR detection, enabling malware research, rule QA, and network sensor pressure testing…

rainkin1993/remote-access-trojan-database

A database of RAT collected from Internet

nccgroup/detectwindowscopyonwriteforapi

Enumerate various traits from Windows processes as an aid to threat hunting

malwarecantfly/vba2graph

Vba2Graph - Generate call graphs from VBA code, for easier analysis of malicious documents.

threatlabz/tools

Ransomware decryption and script deobfuscation utilities from a threat intelligence team, designed for incident responders and malware analysts.

maldroid/maldrolyzer

Simple framework to extract "actionable" data from Android malware (C&Cs, phone numbers etc.)

strangerealintel/orion

A YARA rules repository continuously updated for monitoring the old and new threats from articles, incidents responses ...

deepfield/public-research

DDoS botnet research and indicators of compromise from Nokia Deepfield ERT

threatlabz/iocs

Curated Indicators of Compromise and YARA rules from Zscaler ThreatLabz public reports for threat hunting, malware research, and detection…

100daysofyara/2024

Rules shared by the community from 100 Days of YARA 2024

100daysofyara/2023

Rules Shared by the Community from 100 Days of YARA 2023

watchdogsecurity/ring3-kit

Hides Process From Task Manager Using NT API Hooking (NtQuerySystemInformation)

cert-polska/hfinger

Generates unique fingerprints of malware HTTP requests from pcap files using Tshark, enabling identification and grouping of malware families through…

aetsu/neton

Agent-based tool that collects OS, hardware, file, and hook data from internet-connected sandboxes via HTTPS exfiltration, aiding Red Team artifact…