capa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities such as API calls, byte sequences, and structural patterns without executing the code. It supports multiple file formats including PE, ELF, .NET, and shellcode, and can also process runtime behavior traces from sandbox reports generated by CAPE, DRAKVUF, or VMRay. The tool integrates directly with reverse engineering environments through plugins for IDA Pro and Ghidra, allowing analysts to view capability matches and author detection rules within their disassembler of choice. C
Loki is an endpoint detection tool, forensic artifact analyzer, and threat intelligence scanner. It functions as a YARA-based indicator of compromise scanner designed to identify malicious persistence mechanisms, web shells, and unauthorized administration tools across local and remote systems. The project distinguishes itself by integrating multi-source threat intelligence, allowing for the loading of custom signature sets and encrypted indicators. It combines hash-based artifact detection with YARA rule execution to scan files, process memory, and registry hives for known malicious byte seq
BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.
Die Hauptfunktionen von airbnb/binaryalert sind: Detection and Classification, Detection and Hunting Tools, Development And Analysis Tools, Yara Rule Collections.
Open-Source-Alternativen zu airbnb/binaryalert sind unter anderem: mitre/multiscanner — Modular file scanning/analysis framework. neo23x0/yargen — yarGen is a generator for YARA rules. emersonelectricco/fsf — File Scanning Framework. fireeye/capa — capa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities… neo23x0/loki — Loki is an endpoint detection tool, forensic artifact analyzer, and threat intelligence scanner. It functions as a… alienvault-labs/alienvaultlabs — Alienvault Labs Projects Random Stuff.
