Alternatives and similar repositories for CAPE-parsers

Users that are interested in CAPE-parsers are comparing it to the libraries listed below

• roadwy / DefenderYara
  Extracted Yara rules from Windows Defender mpavbase and mpasbase
  ☆480Updated 4 months ago
• Unprotect-Project / Unprotect_Submission
  Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in thi…
  ☆200Updated 3 months ago
• Bw3ll / sharem
  SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…
  ☆470Updated 5 months ago
• jstrosch / sclauncher
  A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …
  ☆166Updated last year
• dobin / RedEdr
  Collect Windows telemetry for Maldev
  ☆445Updated last month
• ZarKyo / awesome-volatility
  A curated list of ressources for Volatility 2 & 3
  ☆13Updated last year
• jonny-jhnson / TelemetrySource
  ☆258Updated last year
• ExaTrack / Kdrill
  Python tool to check rootkits in Windows kernel
  ☆203Updated 4 months ago
• pathtofile / Sealighter
  Sysmon-Like research tool for ETW
  ☆378Updated 3 years ago
• Malandrone / PowerDecode
  PowerDecode is a PowerShell-based tool that allows to deobfuscate PowerShell scripts obfuscated across multiple layers. The tool performs…
  ☆226Updated last year
• RussianPanda95 / Yara-Rules
  Repository of Yara Rules
  ☆132Updated last week
• pan-unit42 / dotnetfile
  ☆111Updated 3 months ago
• struppigel / hedgehog-tools
  ☆116Updated last week
• Abyss-W4tcher / volatility3-symbols
  Collection of Linux and macOS Volatility3 Intermediate Symbol Files (ISF), suitable for memory analysis 🔍
  ☆244Updated 2 weeks ago
• airbus-cert / yara-ttd
  Use YARA rules on Time Travel Debugging traces
  ☆96Updated 2 years ago
• Abyss-W4tcher / volatility2-profiles
  Collection of Volatility2 profiles, generated against Linux kernels.
  ☆54Updated last month
• thefLink / Hunt-Sleeping-Beacons
  Aims to identify sleeping beacons
  ☆645Updated last year
• forensicxlab / VISION-ProcMon
  A ProcessMonitor visualization application written in rust.
  ☆183Updated 2 years ago
• knez / defender-dump
  Dump quarantined files from Windows Defender
  ☆73Updated 3 years ago
• elastic / labs-releases
  Elastic Security Labs releases
  ☆81Updated 3 weeks ago
• strozfriedberg / cobaltstrike-config-extractor
  Cobalt Strike Beacon configuration extractor and parser.
  ☆157Updated last month
• forrest-orr / moneta
  Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
  ☆790Updated last year
• Neo23x0 / YARA-Performance-Guidelines
  A guide on how to write fast and memory friendly YARA rules
  ☆159Updated 10 months ago
• jonny-jhnson / JonMon
  ☆247Updated 6 months ago
• nasbench / EVTX-ETW-Resources
  Event Tracing For Windows (ETW) Resources
  ☆412Updated last month
• OALabs / hashdb
  Assortment of hashing algorithms used in malware
  ☆387Updated last month
• mgeeky / msidump
  MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.
  ☆223Updated 2 years ago
• hasherezade / mal_unpack
  Dynamic unpacker based on PE-sieve
  ☆787Updated 3 months ago
• commial / experiments
  Expriments
  ☆476Updated last year
• kevoreilly / capemon
  capemon: CAPE's monitor
  ☆142Updated last week