Alternatives and similar repositories for Captain

Users that are interested in Captain are comparing it to the libraries listed below

• monnappa22 / Psinfo
  Psinfo is a Volatility plugin which collects the process related information from the VAD (Virtual Address Descriptor) and PEB (Process E…
  ☆36Updated 8 years ago
• mandiant / apooxml
  Generate YARA rules for OOXML documents.
  ☆38Updated 2 years ago
• sbousseaden / YaraHunts
  Random hunting ordiented yara rules
  ☆96Updated 2 years ago
• StefanKelm / yara-rules
  Links to malware-related YARA rules
  ☆15Updated 2 years ago
• g-les / 100DaysofYARA
  100 Days of YARA to be updated with rules & ideas as the year progresses
  ☆60Updated 2 years ago
• 3vangel1st / 100DaysOfYARA
  ☆27Updated 3 years ago
• jsecurity101 / Windows-API-To-Sysmon-Events
  A repository that maps API calls to Sysmon Event ID's.
  ☆121Updated 2 years ago
• jsecurity101 / Detecting-Process-Injection-Techniques
  This is a repository that is meant to hold detections for various process injection techniques.
  ☆34Updated 5 years ago
• stvemillertime / ConventionEngine
  ConventionEngine - A Yara Rulepack for PDB Path Hunting
  ☆38Updated 2 years ago
• W3ndige / aurora
  Malware similarity platform with modularity in mind.
  ☆78Updated 3 years ago
• Neo23x0 / yaraQA
  YARA rule analyzer to improve rule quality and performance
  ☆101Updated last month
• telsy-cyberops / research
  Telsy CTI Research Team
  ☆57Updated 4 years ago
• memprocfshunt / MemProcFSHunter
  A powershell parser for https://github.com/ufrisk/MemProcFS
  ☆44Updated 4 years ago
• deepinstinct / DeMotet
  Unpacking and decryption tools for the Emotet malware
  ☆46Updated 3 years ago
• Insikt-Group / Research
  Research indicators and detection rules
  ☆66Updated last year
• CIRCL / factual-rules-generator
  Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a machine.
  ☆76Updated 3 years ago
• jschicht / SetMace
  Manipulate timestamps on NTFS
  ☆51Updated 10 years ago
• MITRECND / malchive
  Various capabilities for static malware analysis.
  ☆78Updated 8 months ago
• edygert / runsc
  runsc loads 32/64 bit shellcode (depending on how runsc is compiled) in a way that makes it easy to load in a debugger. This code is base…
  ☆36Updated 2 years ago
• sisoma2 / malware_analysis
  Scripts, Yara rules and other files developed during malware investigations
  ☆25Updated 2 years ago
• dwestgard / threat_hunting_tables
  Theat hunting notes in flat file format and mapped to MITRE's ATT&CK IDs
  ☆42Updated 6 years ago
• woanware / etw-event-dumper
  ☆33Updated 3 years ago
• OTRF / API-To-Event
  A repo to document API functions mapped to security events across diverse platforms
  ☆75Updated 5 years ago
• PonyPC / myaut_contrib
  mod to myaut2exe decompiler
  ☆14Updated 7 years ago
• mkorman90 / sysmon-config-bypass-finder
  Detect possible sysmon logging bypasses given a specific configuration
  ☆111Updated 6 years ago
• BinaryDefense / YaraMemoryScanner
  Simple PowerShell script to enable process scanning with Yara.
  ☆93Updated 2 years ago
• stairwell-inc / cobalt-strike-stager-parser
  ☆34Updated 2 years ago
• hpthreatresearch / tools
  Scripts and tools accompanying HP Threat Research blog posts and reports.
  ☆50Updated last year
• airbus-cert / PSTrace
  Trace ScriptBlock execution for powershell v2
  ☆40Updated 5 years ago
• forensiclunch / ETLParser
  Binary commandline executable to parse ETL files
  ☆67Updated 6 years ago