Malandrone / PowerDecode
PowerDecode is a PowerShell-based tool that allows to deobfuscate PowerShell scripts obfuscated across multiple layers. The tool performs code dynamic analysis, extracting malware hosting URLs and checking http response.It can also detect if the malware attempts to inject shellcode into memory.
☆186Updated last year
Alternatives and similar repositories for PowerDecode
Users that are interested in PowerDecode are comparing it to the libraries listed below
Sorting:
- A collection of tools and detections for the Sliver C2 Frameworj☆125Updated 2 years ago
- A ProcessMonitor visualization application written in rust.☆178Updated last year
- A collection of tools, scripts and personal research☆128Updated last month
- Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR☆239Updated last month
- Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.☆175Updated last week
- ☆201Updated 6 months ago
- ☆159Updated last year
- Dump quarantined files from Windows Defender☆63Updated 3 years ago
- Windows symbol tables for Volatility 3☆85Updated 10 months ago
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆209Updated 2 years ago
- Aims to identify sleeping beacons☆590Updated 5 months ago
- RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.☆261Updated last year
- ☆221Updated 3 months ago
- Repository of Yara Rules☆110Updated last month
- ☆246Updated last year
- ☆299Updated 6 months ago
- Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in thi…☆160Updated last month
- MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR☆621Updated 2 months ago
- Extracted Yara rules from Windows Defender mpavbase and mpasbase☆411Updated 2 weeks ago
- ☆571Updated last week
- AV/EDR Lab environment setup references to help in Malware development☆379Updated 2 months ago
- Collection of Linux and macOS Volatility3 Intermediate Symbol Files (ISF), suitable for memory analysis 🔍☆117Updated 2 weeks ago
- Volatility3 Linux profiles☆40Updated this week
- Collection of Volatility2 profiles, generated against Linux kernels.☆38Updated 2 weeks ago
- DPAPILAB Next Gen, script collection☆82Updated 2 years ago
- Find potential DLL Sideloads on your windows computer☆203Updated 4 months ago
- ☆301Updated 6 months ago
- Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry☆407Updated 9 months ago
- Analyse your malware to surgically obfuscate it☆467Updated 2 months ago
- WTF are these binaries doing?! A list of benign applications that mimic malicious behavior.☆165Updated last month