mandiant Goto Github PK

rvmi-rekall

Rekall Forensics and Incident Response Framework with rVMI extensions

sharpersist

shimcacheparser

siglib

silketw

simplifygraph

IDA Pro plugin to assist with complex graphs

speakeasy

Windows kernel and user mode emulation.

sssdkcmextractor

strace

A DTrace on Windows Reimplementation

stringsifter

A machine learning tool that ranks strings based on their relevance for malware analysis.

sunburst_countermeasures

synfulknock

tf_rl_tutorial

Tutorial: Statistical Relational Learning with Google TensorFlow

thiri-notebook

The Threat Hunting In Rapid Iterations (THIRI) Jupyter notebook is designed as a research aide to let you rapidly prototype threat hunting rules.

threatpursuit-vm

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.

unicorn-libemu-shim

libemu shim layer and win32 environment for Unicorn Engine

vbscript_deobfuscator

Help deobfuscate VBScript

vivisect

pure Python binary analysis framework

vm-packages

Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.

vocab_scraper

Vocabulary Scraper script used in FLARE's analysis of Russian-language Carbanak source code

volatility-plugins

vsphere-cloud-plugin

vulnerability-disclosures

win10_auto

win10_rekall

Rekall Memory Forensic Framework

win10_volatility

An advanced memory forensics framework

yara

The pattern matching swiss knife