0xThiebaut / Signatures
🚧 Currently transfering TLP:CLEAR rules from TLP:AMBER repository...
☆22Updated 5 months ago
Related projects: ⓘ
- Defeating Anti-Debugging Techniques for Malware Analysis☆13Updated last year
- Identifies metadata of .NET binary files.☆21Updated 5 months ago
- Tools for offensive security of NetBackup infrastructures☆38Updated last year
- Automatically spider the result set of a Censys/Shodan search and download all files where the file name or folder path matches a regex.☆27Updated last year
- Collection of generic YARA rules☆14Updated 3 months ago
- ☆22Updated 9 months ago
- Static Decryptor for IcedID Malware☆18Updated last year
- Registry hive parsing the async way☆18Updated 2 weeks ago
- Yara Rules for Modern Malware☆68Updated 6 months ago
- ☆16Updated this week
- Reads and prints information from the website MalAPI.io☆19Updated 2 years ago
- Emulates the VirusTotal "vt" YARA module for livehunt rule debugging/testing☆21Updated last year
- The repository accompanying the Buer Emulation workshop☆23Updated 3 years ago
- Here are some of my malware reversing papers that I will be publishing☆30Updated 2 years ago
- ☆26Updated last month
- Configuration Extractors for Malware☆51Updated 2 weeks ago
- Malware Muncher is a proof-of-concept Python script that utilizes the Frida framework for binary instrumentation and API hooking, enablin…☆42Updated last year
- ☆31Updated 2 years ago
- Small visualizator for PE files☆66Updated 11 months ago
- A tool for interacting with the Anti-Malware Scan Interface API for pen testing purposes.☆56Updated 11 months ago
- A proof-of-concept re-assembler for reverse VNC traffic.☆24Updated last year
- A collection of Tools and Rules for decoding Brute Ratel C4 badgers☆61Updated 2 years ago
- This is a little plugin to copy disassembly in a way that is usable in YARA rules!☆30Updated last year
- Extension functionality for the NightHawk operator client☆26Updated 10 months ago
- Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io☆77Updated 7 months ago
- USB HID driver emulation with PID/VID (0x3bca/0x27bb) of Plenom A/S Busylight Alpha, that is supported by Mimikatz. When mimikatz is exec…☆19Updated 2 years ago
- ☆21Updated last year
- Golang bindings for PE-sieve☆40Updated 10 months ago
- bootloaders.io is a curated list of known malicious bootloaders for various operating systems. The project aims to assist security profes…☆47Updated last year
- Reverse Engineering and Debugging Malware☆28Updated last year