mandiant / apooxml
Generate YARA rules for OOXML documents.
☆37Updated last year
Related projects: ⓘ
- ☆34Updated last year
- Links to malware-related YARA rules☆14Updated last year
- ConventionEngine - A Yara Rulepack for PDB Path Hunting☆36Updated last year
- ☆31Updated 2 years ago
- Scripts, Yara rules and other files developed during malware investigations☆24Updated 2 years ago
- C# User Simulation☆33Updated last year
- 100 Days of YARA to be updated with rules & ideas as the year progresses☆57Updated last year
- Presentation materials for talks I've given.☆20Updated 4 years ago
- This is a repository that is meant to hold detections for various process injection techniques.☆32Updated 4 years ago
- ☆15Updated 2 years ago
- Tracking APT IOCs☆24Updated 3 years ago
- Converts Sigma detection rules to a Splunk alert configuration.☆13Updated 3 years ago
- Specialized tool to dump Position Independent Code.☆21Updated 4 years ago
- ☆27Updated 2 years ago
- Steezy - Ghetto Yara Generation☆15Updated last year
- A set of tools for collecting forensic information☆24Updated 4 years ago
- Standardized Malware Analysis Tool☆51Updated 3 years ago
- Generates YARA rules to detect malware using API hashing☆17Updated 3 years ago
- Yara rules☆18Updated last year
- A tool to help malware analysts signature unique parts of RTF documents☆28Updated 7 months ago
- This batch script file wants to check your EDR systems detection and response capabilities in a more noisy way!☆9Updated 4 years ago
- Trace ScriptBlock execution for powershell v2☆39Updated 4 years ago
- TA505 unpacker Python 2.7☆45Updated 4 years ago
- A list of IOCs applicable to PoshC2☆23Updated 4 years ago
- Modular malware analysis artifact collection and correlation framework☆49Updated 4 months ago
- A list of Mitre Caldera compatible emulation-plans☆14Updated 3 years ago
- runsc loads 32/64 bit shellcode (depending on how runsc is compiled) in a way that makes it easy to load in a debugger. This code is base…☆34Updated last year
- ☆23Updated 4 years ago
- ☆16Updated this week
- ☆10Updated 4 years ago