Entry
Appears in 5 awesome lists
Tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples, described as "the pattern matching swiss army knife" for file patterns and signatures.
Section: Threat intelligence · Tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples, described as "the pattern matching swiss army knife" for file patterns and signatures.
Section: Malware analysis · Identifies and classifies files with rules over strings, byte patterns, and file properties; in maintenance mode, with YARA-X as its successor.
Section: Tools · The pattern matching swiss knife
Section: Forensics Tools · Malware pattern-matching tool used by researchers.
Section: Other · The pattern matching swiss knife
Linux toolkit for reverse-engineering and analyzing malicious software, providing a curated collection of free community-created tools in an Ubuntu-based distribution with Docker container support. Available as a virtual appliance or installable on existing systems, with AI-powered capabilities…
MISP threat sharing platform is a free and open source software helping information sharing of threat intelligence including cyber security indicators. A threat intelligence platform for gathering, sharing, storing and correlating Indicators of Compromise of targeted attacks, threat intelligence,…
All-in-one free threat hunting stack built on Elasticsearch, Logstash, Kafka, and Kibana with Jupyter Notebook integrations, designed by Roberto Rodriguez (Cyb3rWard0g) as a security data science suite for practicing hunting with pre-loaded attack datasets.
An Open Source Intelligence, or OSINT solution to get threat intelligence data about a specific file, an IP or a domain from a single API at scale.
The reference framework for memory forensics with 2,500+ GitHub stars, rewritten in Python 3 with a modular plugin architecture supporting Windows XP through 11, Server equivalents, and Linux 2.6.18 through latest kernels. Essential plugins include windows.pslist and windows.psscan for listing…
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
PowerShell module for hunt teaming via Windows Event logs, enabling rapid triage of security events directly from PowerShell without a full SIEM deployment.
Windows-based security distribution designed for malware analysis, reverse engineering, and incident response, bundling hundreds of curated tools including x64dbg, OllyDbg, IDA Freeware, PEiD/DIE, Process Hacker, Volatility, Sysinternals Suite, and Wireshark. Installation requires a Windows 10/11…