hillu

go-yara

Go bindings for YARA

local-log4j-vuln-scanner

Simple local scanner for vulnerable log4j instances

local-spring-vuln-scanner

Simple local scanner for applications containing vulnerable Spring libraries

go-ntdll

Go interface to NTDLL functions

edr-loadgen

Load generator for measuring overhead generated by EDRs and other logging tools on Linux

linux-audit-parser-rs

Parser for Linux Audit logs

velociraptor-api-rs

Velociraptor API client in Rust

audit-documentation

Documentation and specifications

audit-userspace

Linux audit userspace repository

dumb-inject-rs

Simple DLL injection demo in Rust

go-splunk-client

Splunk REST API client

laurel

Transform Linux Audit logs for SIEM usage

yara

The pattern matching swiss knife

apollon

Proof-of-Concept to evade auditd by writing /proc/PID/mem

asahi-installer

Asahi Linux installer

augeas

A configuration editing tool and API

codesearch

Fast, indexed regexp search over large file trees

conference-materials

cplr

Piler for running C in the shell

gimphash

Imphash-like calculation on Golang binaries

hyperscan

High-performance regular expression matching library

Lsass-Shtinkering

lua-mode

Emacs major mode for editing Lua

pefile

pefile is a Python module to read and work with PE (Portable Executable) files

sleuthkit

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

spyre

simple YARA-based IOC scanner

vblade

The Minimal Userland AoE Target

velociraptor

Digging Deeper....

velociraptor-docs

Documentation site for Velociraptor

vfilter

A library implementing a generic SQL like query language.