adem-hosni/mappedimagesdetectorLightweight native Windows memory scanner for AV/EDR platforms, detecting suspicious mapped images and manual DLL injection techniques by IAT thunk
botherder/krakenCross-platform Yara scanner written in Go
withsecurelabs/ticktockEnumerates Windows timer-queue timers to detect Ekko sleep obfuscation, aiding memory forensics and malware analysis in identifying evasive…
hackinglz/maps_scannerMAPS cloud scanner and response parser for Microsoft Defender research.
sobri3195/pegasus-malware-scanMulti-layered malware scanner combining hash-based verification, behavioral analysis, and sandbox execution for threat detection, incident response,…
x64dbg/x64dbgAn open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
horsicq/detect-it-easyProgram for determining types of files for Windows, Linux and MacOS.
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
forrest-orr/monetaMoneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
mandiant/flare-vmA collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on…
horsicq/xmachoviewerXMachOViewer is a Mach-O viewer for Windows, Linux and MacOS
hydradragonantivirus/hydradragonantivirusDynamic and static analysis with Real Time Malware Analysis with Antivirus for Windows, including open-source XDR (3 EDR projects), ClamAV, YARA-X,…
lilify-jp/squre🛡️ Open-source binary protection toolkit for Windows PE. Nanomite, VM protection, anti-debug, and more.
synacktiv/metamorphA command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows (ETW) AutoLogger sessions.
intrudify/mini-shai-hulud-scannerScanner for the Mini Shai-Hulud npm/PyPI supply chain worm (NHS CC-4781 · CVE-2026-45321). Detects gh-token-monitor persistence, payload artefacts,…
xchwarze/magic-extractorUniversal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.
ldpreload/blacklotusBlackLotus UEFI Windows Bootkit
pan-unit42/dotnetfilePython library for parsing CLR/PE metadata in .NET assemblies, exposing streams and hash fingerprints to support malware analysis and threat hunting.
