rpochron

awesome-threat-intelligence

A curated list of Awesome Threat Intelligence resources

Malware

Course materials for Malware Analysis by RPISEC

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

DeepBlueCLI

php-malware-finder

Detect potentially malicious PHP files

intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

Kam1n0-Community

The Kam1n0 Assembly Analysis Platform

DIE

Dynamic IDA Enrichment

Shell-Detector

Shell Detector – is a application that helps you find and identify php/cgi(perl)/asp/aspx shells. Shell Detector has a “web shells” signature database that helps to identify “web shell” up to 99%.

cuckoo-modified

Modified edition of cuckoo

CDQR

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices

DC3-MWCP

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

LoadDll

Better version of RunDll with GUI. This program allows you to load DLLs on Windows. You can select how to load the DLL. By direct Entry Point call (DllMain) or if you want to call directly an exported function of the DLL.

SysAnalyzer

Automated malcode analysis system - read more ->

elsa

Enterprise Log Search and Archive

Malfunction

Malware Analysis Tool using Function Level Fuzzy Hashing

osq-ext-bin

Extension to osquery windows that enhances it with real-time telemetry, log monitoring and other endpoint data collection

plaso_filters

Scripts to facilitate filtering with Plaso

GithubDownloader

Find and download files from multiple Github repositories

ip2geo

Script to perform bulk local GeoIP lookups (ASN and geo) for IP addresses

Volatility-Plugins

ntfs-linker

An NTFS journal parser

r2-scripts

Multiple radare2 rpipe scripts

CIS-ESP

The Center for Internet Security Enumeration and Scanning Program

vim-log-syntax

Vim syntax for log highlighting

tools

Various tools and scripts

evtx2json

evtx2json extracts events of interest from event logs, dedups them, and exports them to json.

YaraRules

Multiple rules for yara-project for detect compiler/packer/protector

nyx

Threat Intelligence distribution

Google-Analytic-Parser

Parses for Google Analytic values in raw files like RAM, DD images etc.