4 Repos
Awesome GitHub RepositoriesCapability Analyzers
Scans binaries to catalog functional capabilities such as code execution, data exfiltration, and anti-analysis techniques.
Distinct from Malware Analysis: Distinct from Malware Analysis: focuses on cataloging what a binary can do (capabilities) rather than general reverse engineering or behavioral analysis.
Explore 4 awesome GitHub repositories matching security & cryptography · Capability Analyzers. Refine with filters or upvote what's useful.
Awesome Capability Analyzers GitHub Repositories
Finde die besten Repos mit KI.Wir suchen mit KI nach den am besten passenden Repositories.
- mandiant/capa
mandiant/capa
6,062Auf GitHub ansehencapa is a binary capability scanner that identifies high-level behaviors and actions an executable can perform, such as network communication or file manipulation. It functions as a malware behavior analysis tool and a MITRE ATT&CK mapping framework, scanning PE, ELF, .NET, and shellcode files through both static analysis and dynamic sandbox report processing. The tool distinguishes itself through a YAML-based detection rule engine that defines detection logic in human-readable files, with conditions expressed as feature combinations and logical operators. It integrates with IDA Pro, Ghidra,
Scans binaries to catalog functional capabilities such as code execution, data exfiltration, and anti-analysis techniques.
Python - fireeye/capa
fireeye/capa
6,062Auf GitHub ansehencapa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities such as API calls, byte sequences, and structural patterns without executing the code. It supports multiple file formats including PE, ELF, .NET, and shellcode, and can also process runtime behavior traces from sandbox reports generated by CAPE, DRAKVUF, or VMRay. The tool integrates directly with reverse engineering environments through plugins for IDA Pro and Ghidra, allowing analysts to view capability matches and author detection rules within their disassembler of choice. C
Scans PE, ELF, .NET, and shellcode files to identify what a program can do using static analysis rules.
Python - mantvydasb/redteaming-tactics-and-techniques
mantvydasb/RedTeaming-Tactics-and-Techniques
4,620Auf GitHub ansehenDieses Projekt ist eine Wissensdatenbank für Red Teaming und ein Playbook für offensive Sicherheit, das darauf ausgelegt ist, das Verhalten von Angreifern zu simulieren. Es dient als umfassende Sammlung technischer Anleitungen und Taktiken für die Durchführung von Red-Team-Operationen. Das Repository bietet detaillierte Anweisungen für Active-Directory-Exploitation, einschließlich Kerberos-Missbrauch und Domain-Privilege-Escalation. Es behandelt Defense-Evasion durch API-Unhooking und Payload-Obfuskation sowie Windows-Internals-Forschung, die die Manipulation von Kernel-Objekten und Systemspeicher umfasst. Das Fähigkeitsspektrum erstreckt sich auf Netzwerk-Penetrationstests, Malware-Analyse und -Engineering sowie die Bereitstellung von Infrastruktur für offensive Sicherheit. Es enthält zudem Methoden für Lateral Movement, Persistenz und Datenexfiltration in Unternehmensumgebungen.
Provides tools to analyze malware binaries and catalog capabilities such as data exfiltration and anti-analysis techniques.
PowerShelloffensive-securityoscppentesting - rpisec/malware
RPISEC/Malware
4,028Auf GitHub ansehenThis project is a cybersecurity educational resource and courseware designed for malware analysis and reverse engineering. It provides a structured curriculum of lessons, labs, and guided projects focused on detecting and understanding the behavior of malicious software. The resource includes a lab guide for building isolated virtual machine environments to safely execute and study malware. It covers the setup of a specialized toolchain consisting of disassemblers and debuggers used to analyze compiled machine code. The training material covers both static analysis, which examines binary cod
Offers guided projects for detecting and understanding the behavior of real-world encrypted malware samples.
