SentineLabs / macos-ttps-yaraLinks
A ruleset to find potentially malicious code in macOS malware samples
☆40Updated 2 years ago
Alternatives and similar repositories for macos-ttps-yara
Users that are interested in macos-ttps-yara are comparing it to the libraries listed below
Sorting:
- Repository that contains a set of purposefully erroneous Yara rules.☆61Updated 6 months ago
- ForgeArmory provides TTPs that can be used with the TTPForge (https://github.com/facebookincubator/ttpforge).☆121Updated last month
- A zero dependency and customizable Python library for scanning Windows and Linux process memory.☆66Updated 2 years ago
- Rules shared by the community from 100 Days of YARA 2025☆38Updated last month
- macOS forensic timeline generator using the analysis result DBs of mac_apt☆93Updated 2 years ago
- ☆169Updated 4 months ago
- ☆51Updated last month
- Rules Shared by the Community from 100 Days of YARA 2023☆78Updated 2 years ago
- Examine Chrome extensions for security issues☆93Updated 2 months ago
- machofile is a module to parse Mach-O binary files☆90Updated last week
- Segugio allows the execution and tracking of critical steps in the malware detonation process, from clicking on the first stage to extrac…☆151Updated last year
- Detection Engineering with YARA☆87Updated 2 years ago
- An LLM and OCR based Indicator of Compromise Extraction Tool☆38Updated last year
- CyberChef - Detection Engineering, TI, DFIR, Malware Analysis Edition☆66Updated 3 years ago
- pocket guide for core detection engineering concepts☆31Updated 2 years ago
- ☆139Updated 6 months ago
- Run Sigma detection rules on logs from the new MacOS EndpointSecurity Framework☆22Updated 5 years ago
- a common schema for internet-connected service discovery 🔎 📚☆23Updated 2 weeks ago
- Lightweight macOS detection agent built on Santa’s Endpoint Security telemetry.☆105Updated 2 months ago
- ☆102Updated 2 months ago
- Convert Sigma rules to SIEM queries, directly in your browser.☆109Updated 2 weeks ago
- Lightweight Python-Based Malware Analysis Pipeline☆38Updated 2 months ago
- An index of publicly available and open-source threat detection rulesets.☆131Updated 9 months ago
- HASH (HTTP Agnostic Software Honeypot)☆141Updated last year
- Repository documenting how Threat Intelligence and / or a Threat Intelligence Platform can prove its value to an organisation.☆53Updated last year
- God Mode Detection Rules☆135Updated last year
- C2 Active Scanner☆59Updated last year
- Memory Forensic System on Cloud☆92Updated 2 years ago
- acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.☆117Updated 3 weeks ago
- A home for detection content developed by the delivr.to team☆73Updated 6 months ago