44076 matches found
YaraVM
YaraVM Yara is a tool for matching patterns in files, commonly used for malware analysis. Yara rules can be compiled into a binary format that can later be loaded and executed. This repository contains a processor module and a loader for IDA Pro, enabling you to load and analyze compiled Yara...
windows-malware-behavioral-analysis
使用 REMnux 与 FLARE-VM 进行恶意软件行为分析 一个实用的蓝队恶意软件调查项目，演示如何利用行为分析技术在隔离的实验室内安全地分析可疑的 Windows 可执行文件。 与对恶意软件源代码进行逆向工程不同，本项目侧重于观察运行时行为、收集主机与网络遥测数据、提取入侵指标（IOC），并将攻击者活动映射到 MITRE ATT&CK 框架。 目标 构建安全的恶意软件分析实验室 观察恶意软件执行期间的行为 监控 Windows 主机活动 捕获恶意网络流量 识别持久化机制 提取入侵指标（IOC） 将调查结果映射到 MITRE ATT&CK 挖掘检测机会 调查工作流程 阶段 1 —...
Telstra-Cybersecurity-Virtual-Experience-
Telstra-Cybersecurity-Virtual-Experience-Program I participated in Telstra's Security Operations Centre as an Information Security Analyst to gain first-hand experience of the daily tasks and responsibilities of a Security Analyst at Telstra. The tasks carried out: 1. Triaged a malware attack...
lupo
Lupoの使用方法については、https://github.com/malienist/lupo/wiki/Lupo-Wiki を参照してください Lupo — マルウェアIOC抽出機能 マルウェア解析自動化のためのデバッグモジュール Lupoの使用方法に関するステップバイステップの投稿（画像と手順付き）については、こちらの投稿をご覧ください： https://medium.com/@vishalthakur/lupo-malware-ioc-extractor-cc86ae76b85d はじめに...
EDRception
参见：https://malwaretech.com/2023/12/silly-edr-bypasses-and-where-to-find-them.html...
binaryalert
BinaryAlert: サーバーレス、リアルタイム＆レトロアクティブなマルウェア検出 .. image:: https://travis-ci.org/airbnb/binaryalert.svg?branch=master :target: https://travis-ci.org/airbnb/binaryalert :alt: Build Status .. image:: https://coveralls.io/repos/github/airbnb/binaryalert/badge.svg?branch=master :target:...
CVE-2026-41091
🛡️ CVE-2026-41091 - RedSun Microsoft Defender Elevation of Privilege Vulnerability RedSun is a local privilege escalation LPE technique and associated PoC abusing a link-following vulnerability in Microsoft Defender's Malware Protection Engine. It allows a low-privileged authenticated attacker to...
norimaci
Norimaci 「Norimaci」は、macOS向けのシンプルで軽量なマルウェア解析サンドボックスです。このツールは「Noriben」に触発されて作成されました。Norimaciは、Sysinternals Process Monitor procmon の代わりに、OpenBSMまたはMonitor.appの機能を使用してmacOSのシステムアクティビティを監視します。 Norimaciは3つのPythonスクリプトで構成されています。 norimaci.py : メインスクリプト openbsmconv.py : OpenBSM監査ログ変換ツール monitorappconv.p...
CVE-2026-50656
🚨 CVE-2026-50656 — Microsoft Defender "RoguePlanet" Elevation of Privilege Vulnerability in Microsoft Malware Protection Engine ⚠️ Educational and Defensive Security Research Only 📖 Overview CVE-2026-50656 is a high-severity Elevation of Privilege EoP vulnerability affecting the Microsoft Malware...
CVE-2018-18714
CVE-2018-18714 PoC code for CVE-2018-18714 You can find out more @ https://downwithup.github.io/CVEPosts.html Vulnerable Software Download @: https://www.iobit.com/en/malware-fighter.php...
CVE-2018-18026
CVE-2018-18026 PoC Code for CVE-2018-18026 You can find out more @ https://downwithup.github.io/CVEPosts.html Vulnerable Software Download @: https://www.iobit.com/en/malware-fighter.php...
ph0neutria
ph0neutria rastreador de malware ph0neutria v1.0.1 https://github.com/phage-nz/ph0neutria Nota: Este proyecto no se mantiene activamente. Acerca de ph0neutria es un constructor de zoológicos de malware que obtiene muestras directamente de la naturaleza. Todo se almacena en Viper para facilitar el...
ph0neutria
ph0neutria ph0neutria malware crawler v1.0.1 https://github.com/phage-nz/ph0neutria Note: This project is not actively maintained. About ph0neutria is a malware zoo builder that sources samples straight from the wild. Everything is stored in Viper for ease of access and manageability. This projec...
CVE-2014-4936
CVE-2014-4936: Malwarebytes Anti-Malware and Anti-Exploit upgrade hijacking ============= This repository contains the POC for CVE-2014-4936. A full writeup on how the vulnerability works and how to exploit it using the POC has been published here:...
CVE-2023-38831-WinRAR-Vulnerability-Analysis
CVE-2023-38831-WinRAR 漏洞分析 本项目是一个专注于 CVE-2023-38831 的网络安全研究与分析项目。CVE-2023-38831 是一个严重的 WinRAR 漏洞，允许攻击者通过特制的压缩包文件执行恶意代码。 本项目仅在受控实验室环境中进行，仅用于教育和防御性安全目的。 目标 了解该漏洞 分析基于压缩包的攻击 研究安全风险与缓解方法 练习网络安全文档编写 使用的工具 WinRAR Windows 操作系统 虚拟机 GitHub 项目步骤 1. 研究了该漏洞及相关报告 2. 搭建了安全的测试环境 3. 观察了特制压缩包文件的行为 4. 分析了可能的攻击风险 5...
DFIR-LABS
About DFIR LABS is a compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting. This is aimed at Professionals, Security Researchers, Students, CTF Players as well as DF...
cve-2025-55182-scanner
CVE-2025-55182 Indicator Scanner This repository provides a Python-based scanner for indicators of compromise related to CVE-2025-55182 React Server Components RCE and the specific multi-stage malware described in the Asleepace incident report. It is designed to run on Linux and macOS and focuses...
100DaysofYARA
100 Days of YARA 2026 Welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! For now, any associated blogging, walkthroughs, or other musing can be hoste...
-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-
1. Remcos – svchost Injection via Native API Calls The following Binary Ninja snippet reveals the core injection mechanism used by Remcos to inject its payload into svchost.exe. What This Code Does: CreateProcessW with the CREATESUSPENDED flag starts a new svchost process in a suspended state...