MANDIANT

red_team_tool_countermeasures

ThreatPursuit-VM

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.

flare-emu

SilkETW

stringsifter

A machine learning tool that ranks strings based on their relevance for malware analysis.

Azure_Workshop

Mandiant-Azure-AD-Investigator

sunburst_countermeasures

DueDLLigence

FIDL

A sane API for IDA Pro's decompiler. Useful for malware RE and vulnerability research

flare-wmi

SimplifyGraph

IDA Pro plugin to assist with complex graphs

ShimCacheParser

OfficePurge

ioc_writer

flare-qdb

Command-line and Python debugger for instrumenting and modifying native software behavior on Windows and Linux.

thiri-notebook

The Threat Hunting In Rapid Iterations (THIRI) Jupyter notebook is designed as a research aide to let you rapidly prototype threat hunting rules.

route-sixty-sink

Link sources to sinks in C# applications.

heyserial

Programmatically create hunting rules for deserialization exploitation with multiple keywords, gadget chains, object types, encodings, and rule types

flare-bytecode_graph

goauditparser

apooxml

Generate YARA rules for OOXML documents.

ARDvark

ARDvark parses the Apple Remote Desktop (ARD) files to pull out application usage, user activity, and filesystem listings.

pulsesecure_exploitation_countermeasures

siglib

flare-gsoc-2023

Supporting resources and documentation for FLARE @ Google Summer of Code 2023

vbScript_deobfuscator

Help deobfuscate VBScript

rpdebug_qnx

mandiant_managed_hunting

Azure Deployment Templates for Mandiant Managed Huning

yara

The pattern matching swiss knife