SentineLabs/macos-ttps-yara

Stars
39
Rank 693,563 (Top 14 %)
Language YARA
License
GNU General Publi...
Created about 1 year ago
Updated about 1 year ago

SentineLabs/macos-ttps-yara

SentineLabs

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

A ruleset to find potentially malicious code in macOS malware samples

AlphaGolang

IDApython Scripts for Analyzing Golang Binaries

SentinelLabs_RevCore_Tools

The Windows Malware Analysis Reversing Core Tools

XProtect-Malware-Families

Mapping XProtect's obfuscated malware family names to common industry names.

aevt_decompile

This is a work-in-progress command line tool for reversing run-only AppleScripts. It will help parse the output of applescript-disassembler.py into something more human-readable.

S1QL-Queries

Memloader

Memory Loader Open Source Project by Sentinel-Labs.

PowerTrick

This is a repository for the public blog with Labs indicators of compromise and code

log4j_response

Cl0p-ELF-Decryptor

Python3 script which decrypts files encrypted by flawed Cl0p ELF variant.

TrickBot-Anchor

This is a repository for the public blog with Labs indicators of compromise.

aeon

Repository containing Aeon Timeline templates and example projects

SolarWinds_Countermeasures

This tool is designed to identify processes, services, and drivers that SUNBURST attempts to identify on the victim's machine.

TrickBot-Deobfuscator

Code and data related to TrickBot-Deobfuscator blog

Gamaredon-APT

This is a collection of relevant indicators of compromise for the main blog.

Yara

Public SentinelLabs Yara Rules

Shadowpad

Technical Indicators for SentinelLabs ShadowPad research

IOCs

A Collection of IOC's

aoqin_dragon

meteor-express

Hashes and Yara hunting rules for MeteorExpress Wiper

Crypt1_IOCs

Massive unpacking of CryptOne samples