neslog Goto Github PK

3aj-lib

Proof of concept communications from C# via a web browser process

analyzepdf

Tool to help analyze PDF files

arcosi

ArcOSI is the leading open source threat intelligence integration utility for ArcSight SIEM users.

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

aws_zeek

Deploy zeek with a mirror

binarypig

Scalable Binary Data Extraction in Hadoop

bro-osquery

Bro integration with osquery

bro-packages

LIsting of Bro Packages

bro-sysmon

How to Zeek Sysmon Logs!

bro_scripts

Various Bro scripts

brosysmon-vagrant

Vagrant file to create Win32 VM for Bro-Sysmon Environment.

cuckoo2stix

det

(extensible) Data Exfiltration Toolkit (DET)

heavy_pint

Library used to generate malicious PDF files for testing

intel_feeds

Gathering list of intel feeds to use

ja3

JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

ja3_ssl_analysis

ja3_ua

JA3 mapping to HTTP UserAgent

java_idx_parser

Parses Java Cache IDX files

jd-core-java

Java Library for JD-Core, a java decompiler

jsdetox

A Javascript malware analysis tool

malcom

Malcom - Malware Communications Analyzer

malpdfobj

Builds json representation of PDF malware sample

malwoverview

Malwoverview.py is a first response tool to perform an initial and quick triage on either a directory containing malware samples or a specific malware sample.

mics-scanjs

Static analysis tool for javascript code based. Scanjs uses Acorn to convert sources to AST, then walks AST looking for patterns.

midas

Metadata Inspection Database Alerting System

midas_patch

MIDAS Patch

misc

not sure where to put yet

misc-hyara

Yara rule making tool (IDA Plugin)

moloch

Moloch is a open source large scale IPv4 full PCAP capturing, indexing and database system.