findyara-ida

FindYara Use this IDA python plugin to scan your binary with yara rules. All the yara rule matches will be listed with their offset so you can quickly jump to them! 🍻 All credit for this plugin and the code goes to David Berard @p0ly 🍻 This plugin is copied from David's excellent findcrypt-yara...

YaraVM

YaraVM Yara is a tool for matching patterns in files, commonly used for malware analysis. Yara rules can be compiled into a binary format that can later be loaded and executed. This repository contains a processor module and a loader for IDA Pro, enabling you to load and analyze compiled Yara...

yara-rules

yara-rules A collection of my yara rules...

Log4j-CVE-Detect

Log4J-CVE-Detect This repository contains a set of YARA rules for detecting versions of log4j which are vulnerable to CVE-2021-44228, CVE-2021-45046, and / or CVE-2021-45105 by looking for a number of features which appear in affected versions. This tool works recursively on binary files such as...

Orion

Orion A YARA rules repository continuously updated for monitoring the old and new threats from articles, incidents responses...

factual-rules-generator

factual-rules-generator Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a running operating system. The goal of the software is to be able to use a set of rules against collected or acquired digital forensic evidences and find...

magika

Magika Magika is a novel AI-powered file type detection tool that relies on the recent advance of deep learning to provide accurate detection. Under the hood, Magika employs a custom, highly optimized model that only weighs about a few MBs, and enables precise file identification within...

protections-artifacts

Protections Artifacts Elastic Security prevents ransomware and malware, detects advanced threats, and arms responders with vital context. It’s free and open, ready for every endpoint. Protections-Artifacts is the home of our detection logic rules, yara, etc for Elastic Security for endpoint. At...

YaraRules

YaraRules I share YARA rules in this repo...

BlueBox

BlueBox Malware analysis Box and Cyber threat Hunting What is it? Threat intelligence data about a malware, an IP or a domain , URL ? a Quick Analysis suspicious File or Malware ! BlueBox is an Open Source Intelligence, or OSINT solution to get threat intelligence data about a specific file, an I...

YARA_Rules

Yara Rules BY MALGAMY This project contains a collection of Yara rules that can be used to identify and classify various types of files. Table of Contents Overview Installation Usage Contributing Overview Yara is a tool that allows users to create their own rules for identifying and classifying...

CrowdFMS

Copyright C 2013 CrowdStrike, Inc. This file is subject to the terms and conditions of the BSD License. See the file LICENSE in the main directory for details CrowdFMS is a framework for automating collection and processing of samples from VirusTotal, by leveraging the Private API system. This...

awesome-lists

Security lists for SOC/DFIR detections 🐾 Threat Hunting: ThreatHunting keywords Site ThreatHunting keywords Lists ThreatHunting Yara rules ThreatHunting searches Windows Services Searches User-Agents Searches DNS Over HTTPS Searches Suspicious TLDs Searches HijackLibs Searches Phishing & DNSTWIST...

SSMA

SSMA SSMA is a simple malware analyzer written in Python 3. Features: Analyze PE file's header and sections number of sections, entropy of sections/PE file, suspicious section names, suspicious flags in the characteristics of the PE file, etc. Analyze ELF file for Linux malware analysis, it uses...

MalScan

MalScan MalScan is a simple PE File Heuristics Scanners written in python that you can use to quickly analyze a PE file and find out whether anything suspicious exists. It is a simple tool so doesn't offers much fancy features. You are free to extend it or do whatever you want with it. Things...

2023

100 Days of YARA Part 2 - Electric Detectaloo Apologies in advance for the terrible naming, but welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! Fo...

masc

masc A malware web scanner developed during CyperCamp Hackathon 2017 About homepage PyPI Features At the moment, there are some features avaiable for any type of website custom or CMS and some of them only available for specific platforms: Scan any website for malware using OWASP WebMalwareScanne...

yara-rules-vt

yara-rules-vt Collection of YARA rules designed for usage through VirusTotal.com, for more information see https://support.virustotal.com/hc/en-us/articles/360015658497-Crowdsourced-Yara-Rules Example VirusTotal pane that contains InQuest signature fires note, you must login to VTI to see these:...

rasputin

RASPutin Ressources and papers related to my conferences and work on unRASPs. These work is in progress, please be patient : Don't hesitate to contribute / contact me / do PR ! Talks Insomni'hack 2022 - Forging golden hammer against Android app protections This talk is the first from a new serie...

2022

100 Days of YARA Part 2 - Electric Detectaloo Apologies in advance for the terrible naming, but welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! Fo...