Search Results for "yara"
Sort By:
Showing 21 open source projects for "yara"
View related business solutions-
Veeam Data Platform v13.1 - Get Your Free TrialTry Veeam Data Platform today. Experience the unified platform that's secure by design, portable by default, and proven to recover clean, fast, and anywhere.
-
MongoDB Atlas runs apps anywhereMongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.
-
1
YARA
The pattern matching swiss knife for malware researchers
...If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks. -
2
MemProcFS Analyzer
Automated Forensic Analysis of Windows Memory Dumps for DFIR
MemProcFS-Analyzer is a forensic analysis toolset that builds on the MemProcFS virtual filesystem to make volatile memory artefacts easier to browse and interpret. By exposing process memory, kernel objects, and derived artifacts as regular files, the framework lets analysts use familiar filesystem operations and standard tools (editors, grep, diff) to explore memory snapshots. The Analyzer layer adds higher-level parsing and extraction routines—for example, carving strings, locating... -
3
DIE-engine
GUI & console sources for Detect It Easy(DiE)
...The project is designed for identifying file characteristics, signatures, packers, compilers, and other binary properties used during software analysis. Its source tree integrates components for disassembly, entropy analysis, signatures, YARA scanning, static unpacking, and multiple executable formats. Both graphical and command-line workflows are maintained so analysis can be performed interactively or incorporated into scripts. Build configurations cover Windows, Linux, and macOS along with several Linux package formats. The repository is useful both as part of Detect It Easy and as source material for developers studying binary-analysis tooling. -
4
ImHex
A Hex Editor for Reverse Engineers, Programmers
ImHex is a Hex Editor, a tool to display, decode and analyze binary data to reverse engineer their format, extract informations or patch values in them. What makes ImHex special is that it has many advanced features that can often only be found in paid applications. Such features are a completely custom binary template and pattern language to decode and highlight structures in the data, a graphical node-based data processor to pre-process values before they're displayed, a disassembler,... -
99.99% Uptime for MySQL and PostgreSQL DatabasesCloud SQL Enterprise Plus delivers near-zero downtime with 35 days of point-in-time recovery. Supports MySQL, PostgreSQL, and SQL Server.
-
5
GRR
GRR Rapid Response, remote live forensics for incident response
GRR Rapid Response is an incident response framework focused on remote live forensics. It consists of a python client (agent) that is installed on target systems, and python server infrastructure that can manage and talk to clients. The goal of GRR is to support forensics and investigations in a fast, scalable manner to allow analysts to quickly triage attacks and perform analysis remotely. GRR client is deployed on systems that one might want to investigate. On every such system, once... -
6
IntelOwl
Centralized platform for automated threat intelligence analysis
...The system features a modular architecture built around plugins that allow new analyzers, connectors, and integrations to be added easily. These plugins can collect data from external intelligence platforms or generate insights using internal analysis tools such as YARA or static malware analyzers. -
7
Elkeid
Open source solution that can meet the requirements of workloads
Elkeid is an open-source platform for security and intrusion-detection that aims to support a wide variety of deployment contexts — from bare-metal hosts to containers, Kubernetes clusters, and even serverless environments. It was born out of ByteDance’s internal security best practices, offering for community users a subset of its enterprise-grade capabilities. Elkeid combines kernel-level data collection, user-space agents, and runtime instrumentation (RASP) to detect malicious behavior,... -
8
optiSCAN
Scanner antivirus gratuit (ClamAV + YARA) pour Windows
🛡️ Antivirus gratuit pour Windows 10/11 Scanner antivirus pour Windows qui combine ClamAV (GPL-2.0) et les règles YARA pour repérer virus, malwares et fichiers suspects. Interface claire, en français et en anglais. Aucun compte, aucune publicité, aucune télémétrie. Fonctionnalités Analyse à la demande : fichier, dossier ou disque Scan depuis le clic droit de l’Explorateur Mise en quarantaine et suppression des menaces Mise à jour des signatures ClamAV et YARA Exclusion manuelle du dossier optiSCAN dans Windows Defender, après l’installation Export PDF des rapports d’analyse Protection en temps réel en option (service Windows, désactivée par défaut) Prérequis : Windows 10 (version 1809 ou plus récente) ou Windows 11, et le runtime .NET 8 Desktop. ... -
9
Kage-DFIR-toolkit
Kage 影 is a Windows host DFIR triage console. Point it at a suspect machine, get everything back in one sealed chain: artefact collection, Sigma-correlated timeline, YARA verdicts, open sockets tied to processes, local accounts, disk root anomalies, logging blind spots, indicator reputation, and a calibrated risk score with the report behind it.
-
One Monitoring Tool for IT, OT and Cloud | Free TrialModern infrastructure spans data centers, cloud platforms and factory floors, and every blind spot between them is a risk. PRTG supports SNMP, WMI, SSH and other standard protocols to monitor IT, OT and hybrid environments through one customizable dashboard. Build the views your team needs, from network health to application performance, without switching tools. Try PRTG free for 30 days now.
-
10
A professional PE (Portable Executable) analysis and modification tool for Windows executables and DLLs.
-
11
HydraDragonAntivirus
Open Source Antivirus/XDR for Windows operating system
Dynamic and static analysis with Real Time Malware Analysis with Antivirus for Windows, including open-source XDR (3 EDR projects), ClamAV, YARA-X, machine learning AI, behavioral analysis, Unpacker, Deobfuscator, Decompiler, website signatures, Ghidra, Suricata, Sigma, Kernel, Hypervisior based protection and much more than you can imagine. -
12
HydraDragonAntivirus
Windows antivirus gui for ClamAV, YARA and my machine learning
It's no longer cross platform please switch to github repo -
13
XPEViewer
PE file viewer/editor for Windows, Linux and MacOS
XPEViewer is a cross-platform viewer and editor for Microsoft Portable Executable files used by Windows applications. It is designed for developers, malware analysts, and reverse engineers who need to inspect executable structures in detail. The application combines PE parsing with tools for examining binary data, disassembly, symbols, regions, entropy, and memory layout. Integrated hexadecimal viewing and editing provide direct access to raw file contents. The project also incorporates... -
14
DeepBlueCLI
PowerShell Module for Threat Hunting via Windows Event Logs
DeepBlueCLI is a PowerShell-centric threat-hunting toolkit built to extract, normalize, and flag suspicious activity from Windows event logs and Sysmon telemetry. It parses common sources—including Windows Security, System, Application, PowerShell logs, and Sysmon event ID 1—then applies a rich set of detection heuristics for things like suspicious account changes, password guessing and spraying, service tampering, PowerShell obfuscation and download-string usage, long or unusual command... -
15
IDA Signsrch
IDA Pro plug-in of Luigi Auriemma's signsrch signature matching tool.
IDA Pro plug-in conversion of Luigi Auriemma's signsrch signature matching tool. * Deprecated, will no longer be updated, please see my use my superior YARA for IDA plugin here: https://github.com/kweatherman/yara4ida * July 2018, updated to IDA 7.1 Luigi's original signsrch description: "Tool for searching signatures inside files, extremely useful as help in reversing jobs like figuring or having an initial idea of what encryption/- compression algorithm is used for a proprietary protocol or file. ... -
16
Detekt
Malware triaging tool
Detekt is a free Python tool that scans your Windows computer (using Yara, Volatility and Winpmem) for traces of malware. Specifically, it can detect the presence of pre-defined patterns which are unique identifiers of commercial surveillance spyware FinFisher FinSpy and HackingTeam RCS. Note however, that Detekt may not be able to detect the most recent versions of those malware families. They may have been updated or have other versions not detected by this tool. -
17
PhishBlock
A program that detects and blocks phishing, pharming, Hacker's C&C.
PhishBlock is a security program that detects and blocks Phishing, Pharming, Hacker’s C&C(Command and Control) Servers which are located in databases with URLs, DNS hostnames, and IP Addresses. This program detects and blocks Malware URLs, bad Hosts, and bad IP addresses. Recently, most malware codes are delivered covertly to users’ personal computers through Google ads, SNS, Blogs, BBS and so on, which users visit often. And After the malware codes connect the C&C server(or... -
18
HoneyDrive
Honeypots in a box! HoneyDrive is the premier honeypot bundle distro.
HoneyDrive is the premier honeypot Linux distro. It is a virtual appliance (OVA) with Xubuntu Desktop 12.04.4 LTS edition installed. It contains over 10 pre-installed and pre-configured honeypot software packages such as Kippo SSH honeypot, Dionaea and Amun malware honeypots, Honeyd low-interaction honeypot, Glastopf web honeypot and Wordpot, Conpot SCADA/ICS honeypot, Thug and PhoneyC honeyclients and more. Additionally it includes many useful pre-configured scripts and utilities to... -
19
-
20
Yara is a fast, embeddable RSS aggregator and parser. It is written in C++ and exposes a very simple API in C.
-
21
TraceTree
TraceTree - Runtime behavioral analysis tool that maps the process cas
...It sandboxes packages inside Docker, attaches strace to capture every syscall, and builds a directed graph of the full process cascade: every file touched, every network call made, every child process spawned. That graph gets fed into a RandomForest classifier trained on real malware samples, plus YARA rules and n-gram syscall pattern matching, to flag behavioral signatures that static scanners and install-time checks completely miss. The output is a SARIF report you can pipe directly into your security toolchain. TraceTree also includes a dedicated MCP server security module, because as AI agents proliferate, MCP servers have become a live attack surface that nobody was watching. ...
- Previous
- You're on page 1
- Next
