Tools

d-diaa/swordstamp

Semantic Watermarking with Order-Robust Detection over Sub-sentence Units

withsecurelabs/esfang

ESF modular ingestion tool for development and research.

withsecurelabs/flair

Lightweight batch script for semi-automated acquisition of key forensic artefacts from Windows hosts, using only native OS tools to support incident…

withsecurelabs/detectree

Interactive data visualization tool for blue teams to analyze detection data, understand relationships, reduce alert fatigue, and improve incident…

withsecurelabs/ppid-spoofing

Scripts for performing and detecting parent PID spoofing

withsecurelabs/lazarus-sigma-rules

Sigma rules for detecting Lazarus Group TTPs, covering malicious document execution, PowerShell abuse, scheduled tasks, and credential access,…

withsecurelabs/macostriagecollectionscript

Collects comprehensive triage data from macOS for incident response, including system logs, file listings, browser data, shell history, and…

withsecurelabs/volatility-plugins

Volatility plugins for memory forensics, including detection of Gargoyle memory scanning evasion techniques.

withsecurelabs/usb-ninja-detection-poc

Detects USB Ninja keystroke injection attacks by logging keystrokes and application events, providing a proof-of-concept for defensive monitoring.

withsecurelabs/amsidetection

Proof-of-concept tool for detecting AMSI (Antimalware Scan Interface) bypasses and malicious in-memory script activity on Windows endpoints.

withsecurelabs/shadowhammer

Batch-mode checker for Shadowhammer malware indicators, scanning local or provided MAC addresses against known malicious hashes, with offline support…

fireeye/pywintrace

Python ctypes wrapper for Event Tracing for Windows (ETW) enabling session control, event capture, and custom callbacks for security monitoring and…

withsecurelabs/dotnet-gargoyle

A spiritual .NET equivalent to the Gargoyle memory scanning evasion technique

withsecurelabs/doublepulsar-usermode-injector

A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing…

withsecurelabs/radare2-scripts

Collection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…

withsecurelabs/memory-carving-scripts

Scripts for extracting useful information from infected memory dumps

teutekeune/ibssloader

Research tooling to boot Linux on iPad mini 1 via checkm8, patched iBSS/iBEC, and custom bare-metal payloads, including device tree port, kernel…

bdblackhat/admin-panel-finder

Python script to discover admin panel URLs of websites, aiding in security reconnaissance and penetration testing.