MANDIANT

commando-vm

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com

flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.

capa

The FLARE team's open-source tool to identify capabilities in executable files.

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

red_team_tool_countermeasures

flare-ida

IDA Pro utilities from FLARE team

flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool

speakeasy

Windows kernel and user mode emulation.

gocrack

GoCrack is a management frontend for password cracking tools written in Go

Ghidrathon

The FLARE team's open-source extension to add Python 3 scripting to Ghidra.

ReelPhish

capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

GoReSym

Go symbol recovery tool

PwnAuth

ADFSpoof

STrace

A DTrace on Windows Reimplementation

GeoLogonalyzer

GeoLogonalyzer is a utility to analyze remote access logs for anomalies such as travel feasibility and data center sources.

macos-UnifiedLogs

Vulnerability-Disclosures

dncil

The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.

ccmpwn

VM-Packages

Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.

gocrack-ui

The User Interface for GoCrack

citrix-ioc-scanner-cve-2023-3519

SSSDKCMExtractor

gootloader

Collection of scripts used to deobfuscate GOOTLOADER malware samples.

capa-testfiles

Data to test capa's code and rules.

gocat

Provides access to libhashcat

flare-gsoc-2024

Supporting resources and documentation for FLARE @ Google Summer of Code 2024

flare-floss-testfiles

Resources for testing FLOSS by the FLARE team.