Discover mandiant/gocrack Open Source project by MANDIANT (@mandiant)

1

commando-vm

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. [email protected]

PowerShell

6,897

2

flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.

PowerShell

6,334

3

capa

The FLARE team's open-source tool to identify capabilities in executable files.

Python

4,775

4

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

Python

3,155

5

red_team_tool_countermeasures

YARA

2,639

6

flare-ida

IDA Pro utilities from FLARE team

Python

2,031

7

flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool

Python

1,677

8

speakeasy

Windows kernel and user mode emulation.

Python

1,290

9

SharPersist

C#

1,213

10

ThreatPursuit-VM

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.

PowerShell

1,204

11

flare-emu

Python

735

12

stringsifter

A machine learning tool that ranks strings based on their relevance for malware analysis.

Python

672

13

SilkETW

C#

641

14

Mandiant-Azure-AD-Investigator

PowerShell

614

15

Azure_Workshop

HCL

572

16

sunburst_countermeasures

YARA

561

17

Ghidrathon

The FLARE team's open-source extension to add Python 3 scripting to Ghidra.

Java

556

18

capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

528

19

ReelPhish

Python

493

20

iocs

FireEye Publicly Shared Indicators of Compromise (IOCs)

458

21

DueDLLigence

C#

450

22

FIDL

A sane API for IDA Pro's decompiler. Useful for malware RE and vulnerability research

Python

431

23

flare-wmi

C++

412

24

GoReSym

Go symbol recovery tool

Go

379

25

rvmi

rVMI - A New Paradigm For Full System Analysis

C

352

26

PwnAuth

Python

347

27

idawasm

IDA Pro loader and processor modules for WebAssembly

Python

332

28

ADFSpoof

Python

318

29

SimplifyGraph

IDA Pro plugin to assist with complex graphs

C++

303

30

STrace

A DTrace on Windows Reimplementation

C++

299

31

ShimCacheParser

Python

258

32

OfficePurge

C#

256

33

msi-search

C

215

34

macos-UnifiedLogs

Rust

200

35

ioc_writer

Python

195

36

GeoLogonalyzer

GeoLogonalyzer is a utility to analyze remote access logs for anomalies such as travel feasibility and data center sources.

Python

194

37

Vulnerability-Disclosures

C++

183

38

flare-kscldr

FLARE Kernel Shellcode Loader

C

175

39

flare-qdb

Command-line and Python debugger for instrumenting and modifying native software behavior on Windows and Linux.

Python

161

40

flare-dbg

flare-dbg is a project meant to aid malware reverse engineers in rapidly developing debugger scripts.

Python

149

41

thiri-notebook

The Threat Hunting In Rapid Iterations (THIRI) Jupyter notebook is designed as a research aide to let you rapidly prototype threat hunting rules.

Python

146

42

route-sixty-sink

Link sources to sinks in C# applications.

C#

137

43

VM-Packages

Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.

PowerShell

135

44

heyserial

Programmatically create hunting rules for deserialization exploitation with multiple keywords, gadget chains, object types, encodings, and rule types

YARA

130

45

dncil

The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.

Python

124

46

flashmingo

Automatic analysis of SWF files based on some heuristics. Extensible via plugins.

Python

118

47

Reversing

111

48

ioc-scanner-CVE-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781

Shell

91

49

flare-bytecode_graph

Python

82

50

gocrack-ui

The User Interface for GoCrack

Vue

81

51

Volatility-Plugins

Python

80

52

unicorn-libemu-shim

libemu shim layer and win32 environment for Unicorn Engine

C++

70

53

citrix-ioc-scanner-cve-2023-3519

Shell

61

54

AuditParser

Python

56

55

remote_lookup

Resolves DLL API entrypoints for a process w/ remote query capabilities.

Visual Basic

54

56

synfulknock

Lua

48

57

SSSDKCMExtractor

Python

46

58

jitm

JITM is an automated tool to bypass the JIT Hooking protection on a .NET sample.

C++

43

59

goauditparser

Go

39

60

capa-testfiles

Data to test capa's code and rules.

Max

39

61

tf_rl_tutorial

Tutorial: Statistical Relational Learning with Google TensorFlow

Jupyter Notebook

39

62

macOS-tools

Python

38

63

apooxml

Generate YARA rules for OOXML documents.

Python

38

64

gootloader

Collection of scripts used to deobfuscate GOOTLOADER malware samples.

Python

36

65

pycommands

PyCommand Scripts for Immunity Debugger

Python

35

66

vocab_scraper

Vocabulary Scraper script used in FLARE's analysis of Russian-language Carbanak source code

Python

35

67

ARDvark

ARDvark parses the Apple Remote Desktop (ARD) files to pull out application usage, user activity, and filesystem listings.

Python

34

68

rvmi-rekall

Rekall Forensics and Incident Response Framework with rVMI extensions

Python

32

69

gocat

Provides access to libhashcat

Go

29

70

ics_mem_collect

Python

26

71

rvmi-qemu

QEMU with rVMI extensions

C

26

72

IDA_Pro_VoiceAttack_profile

Python

25

73

win10_auto

Python

23

74

pulsesecure_exploitation_countermeasures

YARA

23

75

rvmi-kvm

Linux-KVM with rVMI extensions

C

23

76

pivy-report

Poison Ivy Appendix/Extras

17

77

siglib

Python

15

78

DFUR-Splunk-App

The "DFUR" Splunk application and data that was presented at the 2020 SANS DFIR Summit.

13

79

vbScript_deobfuscator

Help deobfuscate VBScript

VBA

13

80

flare-gsoc-2023

Supporting resources and documentation for FLARE @ Google Summer of Code 2023

13

81

rpdebug_qnx

Python

11

82

mandiant_managed_hunting

Azure Deployment Templates for Mandiant Managed Huning

9

83

flare-floss-testfiles

Resources for testing FLOSS by the FLARE team.

C

6

84

shelidate

Go

2

mandiant/gocrack

mandiant

Reviews

Repository Details

gocrack

Supported Engines

Documentation

License

More Repositories