mandiant / gootloaderLinks
Collection of scripts used to deobfuscate GOOTLOADER malware samples.
☆64Updated 9 months ago
Alternatives and similar repositories for gootloader
Users that are interested in gootloader are comparing it to the libraries listed below
Sorting:
- Memory Baseliner is a script that can compare two windows memory images or perform frequency of occurrence / data stacking analysis on mu…☆55Updated 2 years ago
- A repository hosting example goodware evtx logs containing sample software installation and basic user interaction☆80Updated this week
- Rules shared by the community from 100 Days of YARA 2024☆86Updated 9 months ago
- A C# based tool for analysing malicious OneNote documents☆116Updated 2 years ago
- JPCERT/CC public YARA rules repository☆110Updated 10 months ago
- A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.☆113Updated 3 years ago
- ☆26Updated 3 years ago
- YARA rule analyzer to improve rule quality and performance☆103Updated 6 months ago
- Simple PowerShell script to enable process scanning with Yara.☆96Updated 3 years ago
- ☆75Updated last week
- Active C&C Detector☆156Updated 2 years ago
- Dump quarantined files from Windows Defender☆67Updated 3 years ago
- ☆88Updated 2 months ago
- Initial triage of Windows Event logs☆102Updated last year
- Scripts and tools accompanying HP Threat Research blog posts and reports.☆50Updated last year
- A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.☆97Updated 2 years ago
- Yara Rules for Modern Malware☆79Updated last year
- Full of public notes and Utilities☆127Updated 8 months ago
- The Github project for The Defender's Guide by Luke Paine and Jonathan Johnson☆159Updated 2 years ago
- ☆202Updated 11 months ago
- The Windows Malware Analysis Reversing Core Tools☆96Updated 4 years ago
- A home for detection content developed by the delivr.to team☆71Updated 2 months ago
- A tool to support the reporting of Authenticode Certificates by reducing the effort on individuals to report.☆37Updated last month
- A list of RMMs designed to be used in automation to build alerts☆113Updated 5 months ago
- WTF are these binaries doing?! A list of benign applications that mimic malicious behavior.☆167Updated 6 months ago
- “Intelliroot Code Injection Hunter” is a tool that can to help you identify injected malicious code. The tool can identify and extract po…☆16Updated 3 years ago
- Recycle bin artifact parser☆53Updated 8 months ago
- ☆48Updated 8 months ago
- A specification and style guide for YARA rules☆56Updated last year
- Project based on RegRipper, to extract add'l value/pivot points from TLN events file☆88Updated 8 months ago