Malandrone / PowerDecode
PowerDecode is a PowerShell-based tool that allows to deobfuscate PowerShell scripts obfuscated across multiple layers. The tool performs code dynamic analysis, extracting malware hosting URLs and checking http response.It can also detect if the malware attempts to inject shellcode into memory.
☆172Updated 9 months ago
Alternatives and similar repositories for PowerDecode:
Users that are interested in PowerDecode are comparing it to the libraries listed below
- A ProcessMonitor visualization application written in rust.☆178Updated last year
- A collection of tools, scripts and personal research☆125Updated 7 months ago
- Dump quarantined files from Windows Defender☆60Updated 2 years ago
- ☆155Updated last year
- Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR☆224Updated 11 months ago
- A collection of tools and detections for the Sliver C2 Frameworj☆115Updated last year
- ☆199Updated 3 months ago
- ☆296Updated 3 months ago
- Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in thi…☆152Updated last month
- ☆206Updated 2 weeks ago
- Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.☆164Updated this week
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆203Updated last year
- Repository of Yara Rules☆97Updated last month
- ☆232Updated 9 months ago
- ☆569Updated 3 months ago
- A repository for additional files related to the book Windows Security Internals with PowerShell from No Starch Press.☆152Updated 10 months ago
- MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR☆584Updated 2 months ago
- Aims to identify sleeping beacons☆562Updated 2 months ago
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆307Updated last year
- Extracted Yara rules from Windows Defender mpavbase and mpasbase☆330Updated 3 months ago
- Collection of Linux and macOS Volatility3 Intermediate Symbol Files (ISF), suitable for memory analysis 🔍☆94Updated this week
- Parses $MFT from NTFS file systems☆216Updated 3 weeks ago
- Find potential DLL Sideloads on your windows computer☆174Updated last month
- A suite of tools to disrupt campaigns using the Sliver C2 framework.☆254Updated last year
- Windows symbol tables for Volatility 3☆81Updated 7 months ago
- Collection of Volatility2 profiles, generated against Linux kernels.☆34Updated this week
- The Windows Malware Analysis Reversing Core Tools☆91Updated 4 years ago
- AV/EDR Lab environment setup references to help in Malware development☆363Updated 2 months ago
- ☆117Updated 10 months ago
- ☆375Updated 2 years ago