
maltrail
Real-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…

Real-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…

Blue-team analysis of a malicious DOCX exploiting CVE-2017-0199, covering sandbox detonation, network forensics, IOC extraction, MITRE ATT&CK…

CVE-2017-0199 XLS --> HTA --> VBS --> STEGANOGRAPHY --> DBATLOADER/GULOADER STYLE MALWARE

A Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.

Malware samples, analysis exercises and other interesting resources.

Malicious HTTP traffic explorer

A tool to assist with network-based hunting for GRU's Drovorub malware c2

Parsing Ramnit's traffic

Malcom - Malware Communications Analyzer