Tools

nccgroup/yaml2yara

Generate bulk YARA rules from YAML input

malwaretech/follinaextractor

Extract payload URLs from Follina (CVE-2022-30190) docx and rtf files

tjnel/certgraveyard_yara

Automated YARA rule generation from the Cert Central compromised certificate database.

0x11dfe/file-unpumper

Tool that can be used to trim useless things from a PE file such as the things a file pumper would add.

0rshemesh/jadx-magic-strings

JADX plugin that extracts method names, class references, and source file paths from string constants found in DEX files and decompiled Android code.

shellcromancer/daysofyara-2023

Rules Shared by the Community from 100 Days of YARA 2023 -

100daysofyara/2026

Rules shared by the community from 100 Days of YARA 2026

forentfraps/pe-signgen

Universal signature generation for any system function from all Windows Builds using Winbindex

nexusfuzzy/raccoon_config

Scans a list of raccoon servers from Tria.ge and extracts the config

jacobpimental/nanocore_extractor

Extracts nanocore sample from compile AutoIT script

destiny-creates/goxlr-malware-family

Malware analysis from the domain goxlr.net

squiblydoo/100daysofyara

Rules shared by the community from 100 Days of YARA 2026

dodo-sec/kpot-string-decrypter

IDA python scripts to decrypt strings from KPOT and set those as comments

kinryulabs/rootpacket-cve-2026-31431

Live cryptojacking toolkit with CVE-2026-31431 LPE exploit, container escape, kernel rootkit, and XMRig Monero miner, captured from real attacks for…

lukeslp/redtail-ioc

IOCs and a read-only triage checklist from a real Linux root compromise: RedTail miner, XorDDoS persistence, MoneroOcean miner, DirtyFrag LPE…

jacobsoo/rtf-cleaner

RTF Cleaner, tries to extract URL from malicious RTF samples using CVE-2017-0199 & CVE-2017-8759

spiralbl0ck/analysis-for-stage1-shellcode-loader-from-hacking-

Analysis for stage1 shellcode loader from hacking