SentineLabs / macos-ttps-yaraLinks
A ruleset to find potentially malicious code in macOS malware samples
☆41Updated 2 years ago
Alternatives and similar repositories for macos-ttps-yara
Users that are interested in macos-ttps-yara are comparing it to the libraries listed below
Sorting:
- macOS forensic timeline generator using the analysis result DBs of mac_apt☆93Updated 2 years ago
- Repository that contains a set of purposefully erroneous Yara rules.☆61Updated 5 months ago
- Rules shared by the community from 100 Days of YARA 2025☆37Updated 11 months ago
- machofile is a module to parse Mach-O binary files☆90Updated 4 months ago
- A zero dependency and customizable Python library for scanning Windows and Linux process memory.☆66Updated last year
- Rules Shared by the Community from 100 Days of YARA 2023☆78Updated 2 years ago
- Run Sigma detection rules on logs from the new MacOS EndpointSecurity Framework☆21Updated 4 years ago
- ForgeArmory provides TTPs that can be used with the TTPForge (https://github.com/facebookincubator/ttpforge).☆119Updated last week
- FLARE floss applied to all unpacked+dumped samples in Malpedia, pre-processed for further use.☆62Updated 7 months ago
- SubCrawl is a modular framework for discovering open directories, identifying unique content through signatures and organizing the data w…☆54Updated last year
- C2 Active Scanner☆60Updated last year
- My very personal and opinionatedly organized infosec/cybersec sources in one OPML file☆58Updated 3 years ago
- ☆100Updated 3 weeks ago
- Detection Engineering with YARA☆86Updated last year
- Forensic Artifact Collection Tool for macOS☆116Updated 5 months ago
- An LLM and OCR based Indicator of Compromise Extraction Tool☆38Updated last year
- ☆169Updated 3 months ago
- Track progress and keep notes while working through likethecoins' CTI Self Study Plan☆29Updated 3 years ago
- ☆21Updated 2 months ago
- pocket guide for core detection engineering concepts☆31Updated 2 years ago
- Convert Sigma rules to SIEM queries, directly in your browser.☆107Updated 2 weeks ago
- Segugio allows the execution and tracking of critical steps in the malware detonation process, from clicking on the first stage to extrac…☆150Updated last year
- orc2timeline extracts and analyzes artifacts contained in archives generated with DFIR-ORC.exe to create a timeline from them☆34Updated 6 months ago
- ☆19Updated 3 years ago
- Examine Chrome extensions for security issues☆90Updated last month
- ☆74Updated 2 months ago
- macOS .DS_Store Parser☆72Updated 4 years ago
- A minimal malware analysis sandbox for macOS☆34Updated 2 years ago
- CyberChef - Detection Engineering, TI, DFIR, Malware Analysis Edition☆66Updated 3 years ago
- Repository of tools and resources for analyzing Docker containers☆71Updated 2 years ago