signature-base

قاعدة التوقيعات قاعدة التوقيعات هي قاعدة بيانات توقيعات YARA وIOCs لماسحاتنا LOKI وTHOR Lite تركيز قاعدة التوقيعات 1. قواعد YARA عالية الجودة وIOCs مع أقل عدد من النتائج الإيجابية الخاطئة 2. هيكل واضح 3. تنسيق قواعد متناسق هيكل الدليل iocs - ملفات IOC بسيطة CSV yara - قواعد YARA threatintel -...

CAPEv2

CAPE: استخراج تكوين البرامج الضارة والحمولة - الوثائق CAPE هو صندوق رمل للبرامج الضارة. يُستخدم صندوق الرمل لتنفيذ الملفات الضارة في بيئة معزولة مع تتبع سلوكها الديناميكي وجمع الأدلة الجنائية. تم اشتقاق CAPE من Cuckoo v1 الذي يتميز بالقدرات الأساسية التالية على منصة Windows: التتبع السلوكي القائم...

PortexAnalyzerGUI

PortexAnalyzerGUI Interfaccia grafica per PortEx, una libreria per l'analisi di Portable Executable e Malware Download Pagina delle release Caratteristiche Informazioni header da: MSDOS Header, Rich Header, COFF File Header, Optional Header, Section Table, .NET Metadata Strutture PE: Import...

pharos

Pharos Static Binary Analysis Framework The Pharos static binary analysis framework is a project of the Software Engineering Institute at Carnegie Mellon University. The framework is designed to facilitate the automated analysis of binary programs. It uses the ROSE compiler infrastructure develop...

yara-rules

yara-rules Raccolta di firme YARA da recenti ricerche sul malware Set di regole Dacls Trojan Regola: DaclsLinux.yara Regola: DaclsWindows.yara Riferimento: https://blog.netlab.360.com/dacls-the-dual-platform-rat/ APT32 KerrDown Regola: APT32KerrDown.yara Riferimento:...

CAPE - Malware Configuration And Payload Extraction

CAPE is a malware sandbox. It is derived from Cuckoo and is designed to automate the process of malware analysis with the goal of extracting payloads and configuration from malware. This allows CAPE to detect malware based on payload signatures, as well as automating many of the goals of malware...

ThreatIngestor - Extract And Aggregate Threat Intelligence

An extendable tool to extract and aggregate IOCs from threat feeds. Integrates out-of-the-box with ThreatKB and MISP, and can fit seamlessly into any existing worflow with SQS, Beanstalk, and custom plugins. Overview ThreatIngestor can be configured to watch Twitter, RSS feeds, or other sources,...

Pharos: A Static Binary Analysis Framework

PenTestIT RSS Feed All of us know what static binary analysis means. It means that the analysis of the binary is performed without actually executing it. Almost two years ago, an open source framework - Pharos, was created by the Carnegie Mellon SEI, CERT Division in collaboration with the Lawren...

Artificial Inteligent Packet Inspection Engine: AIEngine

AIEngine is a next generation interactive/programmable Python/Ruby/Java packet inspection engine with capabilities of learning without any human intervention, NIDS Network Intrusion Detection System functionality, DNS domain classification, network collector, network forensics and many others...

QuickSand.io - Tool For Scanning Streams Within Office Documents Plus Xor DB Attack

QuickSand is a compact C framework to analyze suspected malware documents to 1 identify exploits in streams of different encodings, 2 locate and extract embedded executables. By having the ability to locate embedded obfuscated executables, QuickSand could detect documents that contain zero-day or...

Noriben - Portable, Simple, Malware Analysis Sandbox

Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...

Noriben - Your Personal, Portable Malware Sandbox

Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...

[Cuckoo Sandbox v0.6] Software for Automating Analysis of Suspicious Files

Cuckoo Sandbox is an Open Source software for automating analysis of suspicious files. To do so it makes use of custom components that monitor the behavior of the malicious processes while running in an isolated environment. Cuckoo generates a handful of different raw data which include: Native...