pe-sieve
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
binary-analysisforensicsmalware-analysis+2
3.9k
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
decalage2/oletoolsPython toolkit for analyzing MS OLE2 and Office documents, extracting VBA macros, detecting exploits, and performing forensic analysis of structured…
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
binref/refineryComposable command-line toolkit for malware triage and binary analysis: decode, decrypt, carve, and extract indicators from malicious files and…
securisec/chepyChepy is a python lib/cli equivalent of the awesome CyberChef tool.
apr4h/cobaltstrikescanScan files or process memory for CobaltStrike beacons and parse their configuration
struppigel/portexJava library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
pedramamini/iocextractDefanged Indicator of Compromise (IOC) Extractor.
netspooky/inhaleA malware analysis and classification tool.
phxbandit/scripts-and-toolsScripts and utilities to help your hacking needs
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
tstillz/webshell-analyzerWeb shell scanner and analyzer.
michelcrypt4d4mus/yaralyzerVisually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.
crowdstrike/xwf-yara-scannerNative YARA scanner X-Tension for X-Ways Forensics, enabling in-snapshot file scanning with multi-threaded RVS support, report table output, and no…
concinnity-risks/ransomcoinpublicA DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries.
sh1n0g1/z9Detects PowerShell-based malware artifacts from event logs and performs static analysis on PowerShell scripts to identify malicious activity.
synacktiv/synacktiv-rulesPublic repository of Sigma and YARA rules created by Synacktiv