DFIRnotes/rules external links

---

GitHub - View repository

GitHub.dev - Open in online code editor

Star history - Growth chart over time

deps.dev - Dependencies and security vulnerabilities

Gitingest - Export source code for LLM usage

Repomix - Export source code for LLM usage

uithub - Export source code for LLM usage

Close

DFIRnotes/rules

Readme badge preview -

If you own this repo, copy the snippet below and add it to your README.md

---

Copy

[![RelatedRepos](https://img.shields.io/badge/related-repos-yellow)](https://relatedrepos.com/gh/DFIRnotes/rules)

Close

DFIRnotes / rulesView on GitHubMore

• External links
• Readme badge

Some rules, scripts of some use to us

☆11Oct 25, 2024Updated last year

Alternatives and similar repositories for rules

Users that are interested in rules are comparing it to the libraries listed below

• silascutler / MiscMalware

  View on GitHub
  Misc malware stuff
  ☆11Sep 30, 2020Updated 5 years ago
• macubergeek / mal

  View on GitHub
  ☆14May 6, 2016Updated 9 years ago
• OllieJC / tbat

  View on GitHub
  Threat Box Assessment Tool
  ☆19Aug 15, 2021Updated 4 years ago
• hrbrmstr / shodan

  View on GitHub
  R package to work with the Shodan API
  ☆18Feb 14, 2018Updated 8 years ago
• dtmsecurity / 3aj-lib

  View on GitHub
  Proof of concept communications from C# via a web browser process
  ☆21Feb 15, 2019Updated 7 years ago
• OALabs / trashdbg

  View on GitHub
  TrashDBG the world's worse debugger
  ☆23Feb 17, 2022Updated 4 years ago
• h3x2b / yara-rules

  View on GitHub
  Yara rules for detecting malware
  ☆23Sep 9, 2025Updated 5 months ago
• jaegeral / osint-timelines

  View on GitHub
  Providing timelines based on OSINT Reports
  ☆31Jun 21, 2023Updated 2 years ago
• naxonez / YaraRules

  View on GitHub
  Yaras Random
  ☆23Feb 21, 2019Updated 7 years ago
• debernal / talks

  View on GitHub
  ☆23Aug 10, 2020Updated 5 years ago
• Yara-Rules / r2yara

  View on GitHub
  r2yara - Module for Yara using radare2 information
  ☆35Oct 10, 2023Updated 2 years ago
• sar5430 / RizinLayout

  View on GitHub
  ☆28May 9, 2022Updated 3 years ago
• NorthwaveSecurity / kernel-mii

  View on GitHub
  Cobalt Strike (CS) Beacon Object File (BOF) foundation for kernel exploitation using CVE-2021-21551.
  ☆30Jun 7, 2023Updated 2 years ago
• jeFF0Falltrades / IoCs

  View on GitHub
  A collection of Indicators of Compromise (IoCs), most aligning with samples derived from the signatures in the YARA-Signatures repo
  ☆29Jun 11, 2020Updated 5 years ago
• yuvaly0 / exploits

  View on GitHub
  ☆30Jul 18, 2025Updated 7 months ago
• swackhamer / vt_notification_puller

  View on GitHub
  VirusTotal Intelligence Notification Puller
  ☆28Jun 29, 2016Updated 9 years ago
• lolnate / vt-hunter

  View on GitHub
  Automation for VirusTotal
  ☆31May 6, 2016Updated 9 years ago
• advanced-threat-research / DarkSide-Config-Extract

  View on GitHub
  ☆35Oct 29, 2021Updated 4 years ago
• SecurityRiskAdvisors / sra-taxii2-server

  View on GitHub
  TAXII 2.0 Server implemented in Node JS with MongoDB backend
  ☆12Jan 3, 2023Updated 3 years ago
• MarSoft / pebble-mss

  View on GitHub
  Pebble Watchface: Multifunctional Seven Segment
  ☆11Nov 27, 2017Updated 8 years ago
• InitRoot / CVE-2020-6308-PoC

  View on GitHub
  PoC CVE-2020-6308
  ☆36Dec 29, 2020Updated 5 years ago
• PwCUK-CTO / OperationCloudHopper

  View on GitHub
  Indicators of compromise relating to our report on APT10's targeting of global MSPs
  ☆10Sep 26, 2017Updated 8 years ago
• hank / life

  View on GitHub
  Good code.
  ☆17Nov 18, 2018Updated 7 years ago
• restanrm / gans

  View on GitHub
  Go automated nmap scanner
  ☆12Jun 17, 2019Updated 6 years ago
• mr2tone / metasploit-webapp

  View on GitHub
  Metasploit framework via HTTP services
  ☆10Jul 31, 2021Updated 4 years ago
• tdjackey / Grayshell

  View on GitHub
  Some basic shell code, when I learn <Gray Hat Hacking>
  ☆11Dec 6, 2014Updated 11 years ago
• timb-machine / packet-monkey

  View on GitHub
  Packet Monkey is a tool to filter and classify PCAPs using Wireshark filters
  ☆11May 10, 2025Updated 9 months ago
• blacklotuslabs / Research

  View on GitHub
  The mission of Black Lotus Labs is to leverage our network visibility to both help protect customers and keep the internet clean.
  ☆12Jun 18, 2021Updated 4 years ago
• gdbinit / delambert

  View on GitHub
  GreenLambert macOS IDA plugin to deobfuscate strings
  ☆14Oct 4, 2021Updated 4 years ago
• nccgroup / Royal_APT

  View on GitHub
  Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research
  ☆53Mar 16, 2018Updated 7 years ago
• yo-yo-yo-jbo / macos_app_structure

  View on GitHub
  ☆47Apr 10, 2023Updated 2 years ago
• ctxis / capemon

  View on GitHub
  CAPE monitor DLLs
  ☆41Dec 3, 2019Updated 6 years ago
• mishrasunny174 / SROP

  View on GitHub
  A repository containing sample srop exploits and vulnerable binaries.
  ☆12Sep 17, 2019Updated 6 years ago
• shadowbq / pastenum

  View on GitHub
  Pastenum is a text dump enumeration tool.
  ☆14Dec 9, 2013Updated 12 years ago
• rshipp / slipm-honeypot

  View on GitHub
  A simple low-interaction port monitoring honeypot.
  ☆19Jun 14, 2020Updated 5 years ago
• isciurus / windbgshark

  View on GitHub
  Automatically exported from code.google.com/p/windbgshark
  ☆11Jul 1, 2015Updated 10 years ago
• turkmenkaan / Learning-RE-PWN

  View on GitHub
  A collection of resources to learn Reverse Engineering and Binary Exploitation
  ☆11Nov 11, 2020Updated 5 years ago
• Powershell-Offense / Post-Exploitation

  View on GitHub
  \ PowerAvails Powershell /
  ☆10Jun 30, 2018Updated 7 years ago
• Shrimpey / UnityUnmanagedPlugins

  View on GitHub
  This is a database of sample c++ functions that can be run from Unity C# script.
  ☆11Jan 21, 2019Updated 7 years ago