SentineLabs / macos-ttps-yaraLinks
A ruleset to find potentially malicious code in macOS malware samples
☆40Updated last year
Alternatives and similar repositories for macos-ttps-yara
Users that are interested in macos-ttps-yara are comparing it to the libraries listed below
Sorting:
- Rules shared by the community from 100 Days of YARA 2025☆33Updated 5 months ago
- macOS forensic timeline generator using the analysis result DBs of mac_apt☆94Updated last year
- Repository that contains a set of purposefully erroneous Yara rules.☆52Updated last year
- A zero dependency and customizable Python library for scanning Windows and Linux process memory.☆66Updated last year
- ☆146Updated last month
- ForgeArmory provides TTPs that can be used with the TTPForge (https://github.com/facebookincubator/ttpforge).☆113Updated 9 months ago
- Run Sigma detection rules on logs from the new MacOS EndpointSecurity Framework☆20Updated 4 years ago
- ☆73Updated 5 months ago
- Examine Chrome extensions for security issues☆85Updated 4 months ago
- Simple Workspace Attack Tool (SWAT) is a tool for simulating malicious behavior against Google Workspace in reference to the MITRE ATT&CK…☆165Updated 9 months ago
- Rules Shared by the Community from 100 Days of YARA 2023☆77Updated 2 years ago
- CyberChef - Detection Engineering, TI, DFIR, Malware Analysis Edition☆64Updated 2 years ago
- pocket guide for core detection engineering concepts☆29Updated 2 years ago
- An index of publicly available and open-source threat detection rulesets.☆118Updated 2 months ago
- ☆92Updated 2 months ago
- Forensic Artifact Collection Tool for macOS☆111Updated 10 months ago
- Convert Sigma rules to SIEM queries, directly in your browser.☆91Updated last week
- An LLM and OCR based Indicator of Compromise Extraction Tool☆33Updated 7 months ago
- orc2timeline extracts and analyzes artifacts contained in archives generated with DFIR-ORC.exe to create a timeline from them☆33Updated 2 weeks ago
- ☆257Updated last week
- Detection Engineering with YARA☆87Updated last year
- God Mode Detection Rules☆134Updated 11 months ago
- ☆17Updated 3 weeks ago
- SECurityTr8Ker monitors the SEC's RSS feed for 8-K filings with cybersecurity incident disclosures.☆77Updated 3 weeks ago
- Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.☆135Updated last week
- Tools and scripts to deploy and manage OpenRelik instances☆14Updated last month
- HASH (HTTP Agnostic Software Honeypot)☆138Updated last year
- Segugio allows the execution and tracking of critical steps in the malware detonation process, from clicking on the first stage to extrac…☆151Updated 9 months ago
- My very personal and opinionatedly organized infosec/cybersec sources in one OPML file☆57Updated 2 years ago
- Repository of tools and resources for analyzing Docker containers☆66Updated last year