kirk-sayre-work / ViperMonkey
A VBA parser and emulation engine to analyze malicious macros.
☆91Updated this week
Related projects ⓘ
Alternatives and complementary repositories for ViperMonkey
- Set of Yara rules for finding files using magics headers☆135Updated 4 years ago
- "Evolving AppCompat/AmCache data analysis beyond grep"☆197Updated 3 years ago
- c2 traffic☆188Updated last year
- Random hunting ordiented yara rules☆95Updated last year
- Invoke-LiveResponse☆145Updated 2 years ago
- YARA rule metadata specification and validation utility / Spécification et validation pour les règles YARA☆98Updated 2 months ago
- Various capabilities for static malware analysis.☆75Updated 2 months ago
- Signature engine for all your logs☆160Updated 11 months ago
- Automatically create YARA rules from malicious documents.☆208Updated 2 years ago
- ☆294Updated 4 years ago
- YARA rule analyzer to improve rule quality and performance☆93Updated 11 months ago
- A repo to document API functions mapped to security events across diverse platforms☆75Updated 5 years ago
- EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.☆189Updated 4 years ago
- Extract BITS jobs from QMGR queue and store them as CSV records☆74Updated 4 months ago
- Stand-alone parser for User Access Logging from Server 2012 and newer systems☆71Updated 10 months ago
- Collection of useful, up to date, Carbon Black Response Queries☆83Updated 4 years ago
- Automatic YARA rule generation for Malpedia☆154Updated 2 years ago
- Yet another registry parser☆129Updated 2 years ago
- A modern Python-3-based alternative to RegRipper☆187Updated this week
- A Splunk app to use MISP in background☆109Updated 2 weeks ago
- Hollowfind is a Volatility plugin to detect different types of process hollowing techniques used in the wild to bypass, confuse, deflect …☆130Updated 2 years ago
- Valhalla API Client☆63Updated last year
- ATT&CK Remote Threat Hunting Incident Response☆198Updated 5 years ago
- Automagically extract forensic timeline from volatile memory dump☆123Updated 6 months ago
- Sigma Detection Rule Repository☆85Updated 4 years ago
- Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.☆63Updated last year
- Dump of organized knowledge on DFIR☆132Updated 3 years ago
- ☆31Updated 2 weeks ago
- Parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files☆115Updated 5 months ago
- This repository contains files from AppGate / Immunity Malware Analysis Team.☆21Updated 3 years ago