4 dépôts
Awesome GitHub RepositoriesCapability Analyzers
Scans binaries to catalog functional capabilities such as code execution, data exfiltration, and anti-analysis techniques.
Distinct from Malware Analysis: Distinct from Malware Analysis: focuses on cataloging what a binary can do (capabilities) rather than general reverse engineering or behavioral analysis.
Explore 4 awesome GitHub repositories matching security & cryptography · Capability Analyzers. Refine with filters or upvote what's useful.
Awesome Capability Analyzers GitHub Repositories
Trouvez les meilleurs dépôts grâce à l'IA.Nous recherchons les dépôts les plus pertinents grâce à l'IA.
- mandiant/capa
mandiant/capa
6,062Voir sur GitHubcapa is a binary capability scanner that identifies high-level behaviors and actions an executable can perform, such as network communication or file manipulation. It functions as a malware behavior analysis tool and a MITRE ATT&CK mapping framework, scanning PE, ELF, .NET, and shellcode files through both static analysis and dynamic sandbox report processing. The tool distinguishes itself through a YAML-based detection rule engine that defines detection logic in human-readable files, with conditions expressed as feature combinations and logical operators. It integrates with IDA Pro, Ghidra,
Scans binaries to catalog functional capabilities such as code execution, data exfiltration, and anti-analysis techniques.
Python - fireeye/capa
fireeye/capa
6,062Voir sur GitHubcapa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities such as API calls, byte sequences, and structural patterns without executing the code. It supports multiple file formats including PE, ELF, .NET, and shellcode, and can also process runtime behavior traces from sandbox reports generated by CAPE, DRAKVUF, or VMRay. The tool integrates directly with reverse engineering environments through plugins for IDA Pro and Ghidra, allowing analysts to view capability matches and author detection rules within their disassembler of choice. C
Scans PE, ELF, .NET, and shellcode files to identify what a program can do using static analysis rules.
Python - mantvydasb/redteaming-tactics-and-techniques
mantvydasb/RedTeaming-Tactics-and-Techniques
4,620Voir sur GitHubCe projet est une base de connaissances red teaming et un playbook de sécurité offensive conçu pour simuler le comportement d'un adversaire. Il sert de collection complète de guides techniques et de tactiques pour mener des opérations de red team. Le dépôt fournit des instructions détaillées pour l'exploitation d'Active Directory, y compris l'abus de Kerberos et l'élévation de privilèges de domaine. Il couvre l'évasion de défense via le déhooking d'API et l'obfuscation de payload, ainsi que la recherche sur les composants internes de Windows impliquant la manipulation d'objets noyau et de la mémoire système. La surface de capacité s'étend aux tests de pénétration réseau, à l'analyse et à l'ingénierie de logiciels malveillants, et au déploiement d'infrastructures de sécurité offensive. Il inclut également des méthodes pour le mouvement latéral, la persistance et l'exfiltration de données dans les environnements d'entreprise.
Provides tools to analyze malware binaries and catalog capabilities such as data exfiltration and anti-analysis techniques.
PowerShelloffensive-securityoscppentesting - rpisec/malware
RPISEC/Malware
4,028Voir sur GitHubThis project is a cybersecurity educational resource and courseware designed for malware analysis and reverse engineering. It provides a structured curriculum of lessons, labs, and guided projects focused on detecting and understanding the behavior of malicious software. The resource includes a lab guide for building isolated virtual machine environments to safely execute and study malware. It covers the setup of a specialized toolchain consisting of disassemblers and debuggers used to analyze compiled machine code. The training material covers both static analysis, which examines binary cod
Offers guided projects for detecting and understanding the behavior of real-world encrypted malware samples.
