MANDIANT (@mandiant)
Guthub

mandiant

Twitter logo Share LinkedIn logo Share Facebook logo Share
  • Stars
    star
    43,010
  • Global Org. Rank 364 (Top 0.2 %)
  • Registered almost 14 years ago
  • Most used languages
    Python
         46.8 %
    C++
         7.8 %
    C
         7.8 %
    C#
         6.5 %
    PowerShell
         6.5 %
    Go
         5.2 %
    YARA     5.2 %
    Shell
         2.6 %
    Java
         1.3 %
    Max     1.3 %
    HCL     1.3 %
    Rust
         1.3 %
    Visual Basic     1.3 %
    Jupyter Notebook
         1.3 %
    Vue     1.3 %
    Lua
         1.3 %
    VBA     1.3 %

Top repositories

1

commando-vm

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. [email protected]
PowerShell
6,656
star
2

flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
PowerShell
5,733
star
3

capa

The FLARE team's open-source tool to identify capabilities in executable files.
Python
3,857
star
4

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Python
2,971
star
5

red_team_tool_countermeasures

YARA
2,610
star
6

flare-ida

IDA Pro utilities from FLARE team
Python
2,031
star
7

flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool
Python
1,677
star
8

speakeasy

Windows kernel and user mode emulation.
Python
1,290
star
9

SharPersist

C#
1,213
star
10

ThreatPursuit-VM

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.
PowerShell
1,184
star
11

gocrack

GoCrack is a management frontend for password cracking tools written in Go
Go
1,101
star
12

flare-emu

Python
735
star
13

SilkETW

C#
641
star
14

stringsifter

A machine learning tool that ranks strings based on their relevance for malware analysis.
Python
636
star
15

Mandiant-Azure-AD-Investigator

PowerShell
593
star
16

Azure_Workshop

HCL
572
star
17

sunburst_countermeasures

YARA
560
star
18

Ghidrathon

The FLARE team's open-source extension to add Python 3 scripting to Ghidra.
Java
556
star
19

ReelPhish

Python
493
star
20

capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs
485
star
21

iocs

FireEye Publicly Shared Indicators of Compromise (IOCs)
458
star
22

DueDLLigence

C#
450
star
23

FIDL

A sane API for IDA Pro's decompiler. Useful for malware RE and vulnerability research
Python
431
star
24

flare-wmi

C++
412
star
25

GoReSym

Go symbol recovery tool
Go
379
star
26

rvmi

rVMI - A New Paradigm For Full System Analysis
C
352
star
27

PwnAuth

Python
347
star
28

idawasm

IDA Pro loader and processor modules for WebAssembly
Python
332
star
29

ADFSpoof

Python
318
star
30

SimplifyGraph

IDA Pro plugin to assist with complex graphs
C++
303
star
31

STrace

A DTrace on Windows Reimplementation
C++
299
star
32

ShimCacheParser

Python
258
star
33

OfficePurge

C#
256
star
34

msi-search

C
215
star
35

ioc_writer

Python
195
star
36

GeoLogonalyzer

GeoLogonalyzer is a utility to analyze remote access logs for anomalies such as travel feasibility and data center sources.
Python
191
star
37

macos-UnifiedLogs

Rust
187
star
38

flare-kscldr

FLARE Kernel Shellcode Loader
C
175
star
39

Vulnerability-Disclosures

C++
166
star
40

flare-qdb

Command-line and Python debugger for instrumenting and modifying native software behavior on Windows and Linux.
Python
161
star
41

flare-dbg

flare-dbg is a project meant to aid malware reverse engineers in rapidly developing debugger scripts.
Python
149
star
42

thiri-notebook

The Threat Hunting In Rapid Iterations (THIRI) Jupyter notebook is designed as a research aide to let you rapidly prototype threat hunting rules.
Python
146
star
43

route-sixty-sink

Link sources to sinks in C# applications.
C#
137
star
44

heyserial

Programmatically create hunting rules for deserialization exploitation with multiple keywords, gadget chains, object types, encodings, and rule types
YARA
130
star
45

dncil

The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.
Python
124
star
46

flashmingo

Automatic analysis of SWF files based on some heuristics. Extensible via plugins.
Python
118
star
47

VM-Packages

PowerShell
117
star
48

Reversing

111
star
49

ioc-scanner-CVE-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781
Shell
91
star
50

flare-bytecode_graph

Python
82
star
51

gocrack-ui

The User Interface for GoCrack
Vue
81
star
52

Volatility-Plugins

Python
80
star
53

unicorn-libemu-shim

libemu shim layer and win32 environment for Unicorn Engine
C++
70
star
54

citrix-ioc-scanner-cve-2023-3519

Shell
61
star
55

AuditParser

AuditParser
Python
56
star
56

remote_lookup

Resolves DLL API entrypoints for a process w/ remote query capabilities.
Visual Basic
54
star
57

synfulknock

Lua
48
star
58

SSSDKCMExtractor

Python
46
star
59

jitm

JITM is an automated tool to bypass the JIT Hooking protection on a .NET sample.
C++
43
star
60

goauditparser

Go
39
star
61

tf_rl_tutorial

Tutorial: Statistical Relational Learning with Google TensorFlow
Jupyter Notebook
39
star
62

macOS-tools

Python
38
star
63

apooxml

Generate YARA rules for OOXML documents.
Python
38
star
64

gootloader

Collection of scripts used to deobfuscate GOOTLOADER malware samples.
Python
36
star
65

capa-testfiles

Data to test capa's code and rules.
Max
35
star
66

pycommands

PyCommand Scripts for Immunity Debugger
Python
35
star
67

vocab_scraper

Vocabulary Scraper script used in FLARE's analysis of Russian-language Carbanak source code
Python
35
star
68

ARDvark

ARDvark parses the Apple Remote Desktop (ARD) files to pull out application usage, user activity, and filesystem listings.
Python
34
star
69

rvmi-rekall

Rekall Forensics and Incident Response Framework with rVMI extensions
Python
32
star
70

gocat

Provides access to libhashcat
Go
29
star
71

ics_mem_collect

Python
26
star
72

rvmi-qemu

QEMU with rVMI extensions
C
26
star
73

IDA_Pro_VoiceAttack_profile

Python
25
star
74

win10_auto

Python
23
star
75

pulsesecure_exploitation_countermeasures

YARA
23
star
76

rvmi-kvm

Linux-KVM with rVMI extensions
C
23
star
77

pivy-report

Poison Ivy Appendix/Extras
17
star
78

siglib

Python
15
star
79

vbScript_deobfuscator

Help deobfuscate VBScript
VBA
13
star
80

flare-gsoc-2023

Supporting resources and documentation for FLARE @ Google Summer of Code 2023
13
star
81

DFUR-Splunk-App

The "DFUR" Splunk application and data that was presented at the 2020 SANS DFIR Summit.
13
star
82

rpdebug_qnx

Python
11
star
83

mandiant_managed_hunting

Azure Deployment Templates for Mandiant Managed Huning
9
star
84

flare-floss-testfiles

Resources for testing FLOSS by the FLARE team.
C
6
star