Malware protection tool
For malware protection tools, the strongest matches are cisco-talos/clamav-devel (ClamAV is a self-hostable open-source antivirus engine providing core), kevoreilly/capev2 (This repository is a comprehensive malware analysis sandbox that) and cuckoosandbox/cuckoo (Cuckoo is an open-source malware analysis system that executes). comodosecurity/openedr and rfxn/linux-malware-detect round out the shortlist. Each is ranked by relevance to your query, popularity and recent activity.
The best open-source malware protection tools for developers, ranked by GitHub stars and active maintenance. Compare and pick the right one.
Malware protection tool
Find the best repos with AI.We'll search the best matching repositories with AI.
- cisco-talos/clamav-devel
Cisco-Talos/clamav-devel
6,887View on GitHubClamAV is an open-source antivirus engine and malware detection scanner. It identifies trojans, viruses, and other malicious software by scanning files and data streams against a database of known signatures. The system functions as a signature-based threat detector, allowing for the implementation of threat intelligence by turning malware samples into actionable signatures. It supports the creation of custom malware signatures to identify specific or specialized security threats. The engine provides capabilities for endpoint security monitoring and comprehensive malware detection scanning a
ClamAV is a self-hostable open-source antivirus engine providing core signature detection, file scanning, and command-line utilities for malware threat analysis.
CDetection Signature DevelopmentMalware Signature FormatsMalware Signature Engineering - kevoreilly/capev2
kevoreilly/CAPEv2
3,284View on GitHubMalware Configuration And Payload Extraction
This repository is a comprehensive malware analysis sandbox that automatically executes files, extracts payloads, and generates detection signatures, directly matching the core needs of this search.
PythonYara Rule Collections - cuckoosandbox/cuckoo
cuckoosandbox/cuckoo
5,959View on GitHubCuckoo is an open-source automated malware analysis system that executes suspicious files inside isolated virtual machines and produces structured behavioral reports. The platform captures system calls, file operations, and network activity during execution, compiling them into comprehensive analysis documents for programmatic consumption. The system operates through a modular analysis pipeline that processes behavioral data, applying YARA signature patterns against captured artifacts to identify known malware families. Each analysis run starts from a clean virtual machine snapshot to ensure
Cuckoo is an open-source malware analysis system that executes suspicious files in isolated virtual machines and applies YARA signatures to generate comprehensive behavioral reports.
JavaScriptYARA Rule Execution - comodosecurity/openedr
ComodoSecurity/openedr
2,603View on GitHubOpenEDR is an endpoint detection and response platform designed to collect telemetry and monitor system activity to identify security breaches. It functions as a host-based intrusion detection system and telemetry collector, gathering detailed data on process, network, and file activity. The system includes a dockerized security stack that bundles search, logging, and visualization tools into containers for analyzing endpoint telemetry. It features a security event visualizer that maps process lineage and indexes logs to facilitate root-cause analysis of attacks. The platform provides capabi
OpenEDR is an endpoint detection and response platform that monitors system activity and network telemetry for threat hunting, though it lacks direct signature-based file scanning capabilities.
C++Intrusion Detection SystemsIntrusion Detection Systems - rfxn/linux-malware-detect
rfxn/linux-malware-detect
1,456View on GitHubLinux Malware Detect is a security platform designed for Linux server environments to identify and isolate malicious files. It functions as a multi-engine scanner that utilizes signature-based detection, heuristic analysis, and pattern matching to maintain system integrity. The tool provides automated auditing and real-time monitoring to detect unauthorized modifications as they occur. The system distinguishes itself through kernel-level event monitoring, which triggers immediate scans upon file changes, and checkpoint-based scan resumption, which allows long-running operations to pause and r
This multi-engine Linux malware scanner provides signature detection, heuristic analysis, file scanning, and real-time monitoring through a command-line interface, directly matching the core requirements for analyzing and protecting against threats.
ShellLinux Malware ScannersInotify-Based WatchersMalware Quarantines - stamparm/maltrail
stamparm/maltrail
8,498View on GitHubMaltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o
Maltrail is a network traffic monitoring and intrusion detection system featuring signature matching and heuristic analysis, providing a self-hostable server and sensor architecture for tracking security threats.
PythonNetwork Intrusion Detection - radare/radare2
radare/radare2
24,129View on GitHubradare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p
Radare2 is a powerful reverse engineering framework and binary analysis toolset well-suited for inspecting malicious executables and understanding file structures, though it focuses more on deep binary analysis than end-to-end network monitoring or automated signature scanning out of the box.
CBinary Analysis ToolsBinary Analysis Capabilities - neo23x0/loki
Neo23x0/Loki
3,763View on GitHubLoki is an endpoint detection tool, forensic artifact analyzer, and threat intelligence scanner. It functions as a YARA-based indicator of compromise scanner designed to identify malicious persistence mechanisms, web shells, and unauthorized administration tools across local and remote systems. The project distinguishes itself by integrating multi-source threat intelligence, allowing for the loading of custom signature sets and encrypted indicators. It combines hash-based artifact detection with YARA rule execution to scan files, process memory, and registry hives for known malicious byte seq
Loki is a YARA-based endpoint scanning and threat intelligence tool that supports file scanning, signature detection, and forensic analysis, though it lacks native network monitoring features.
PythonYARA Rule Execution - apklab/apklab
APKLab/APKLab
3,878View on GitHubAPKLab is an integrated security analysis platform and reverse engineering IDE for Android applications. It provides a unified environment for decompiling binaries into source code, repackaging modified applications into signed installers, and performing comprehensive security analysis. The platform distinguishes itself by combining static and dynamic analysis workflows. It enables the injection of runtime hooks and gadget libraries to monitor application behavior, while providing specialized patching capabilities to intercept and decrypt encrypted network traffic via a proxy. The toolkit co
APKLab is an integrated security analysis platform and reverse engineering IDE for Android applications that provides static and dynamic analysis workflows, matching the malware analysis category though it is specialized specifically for mobile binaries rather than general malware protection.
TypeScriptAndroid APK Repackaging ToolsMobile Application AnalysisAndroid Application Reverse Engineering - fireeye/flare-floss
fireeye/flare-floss
4,054View on GitHubThis project is a binary static analysis tool designed to recover hidden and non-standard encoded strings from compiled binaries. It functions as a malware analysis utility and string decryptor, extracting obfuscated text to reveal concealed program behavior without executing the code. The tool automates the recovery of embedded strings through a combination of emulated instruction execution and abstract syntax tree evaluation. It utilizes pattern-based heuristic detection to identify obfuscation routines and employs cross-platform binary parsing to process multiple executable formats. The s
It is a specialised static analysis tool for malware investigation that extracts obfuscated strings from binaries, though it focuses specifically on deobfuscation rather than being an all-in-one suite.
PythonStatic Binary AnalysisInstruction-Level EmulatorsMalware Analysis Tools - mandiant/capa
mandiant/capa
6,062View on GitHubcapa is a binary capability scanner that identifies high-level behaviors and actions an executable can perform, such as network communication or file manipulation. It functions as a malware behavior analysis tool and a MITRE ATT&CK mapping framework, scanning PE, ELF, .NET, and shellcode files through both static analysis and dynamic sandbox report processing. The tool distinguishes itself through a YAML-based detection rule engine that defines detection logic in human-readable files, with conditions expressed as feature combinations and logical operators. It integrates with IDA Pro, Ghidra,
Capa is a specialized binary capability scanner that performs static and dynamic analysis to identify malware behaviors and map them to threat frameworks, though it lacks built-in network monitoring features.
PythonExecutable Capability AnalysisBinary Capability Rule EnginesCapability Analyzers - hasherezade/pe-sieve
hasherezade/pe-sieve
3,559View on GitHubpe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes. The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade
Pe-sieve is a specialised command-line tool for scanning Windows process memory to detect malware implants and memory injections, fitting the malware analysis category well despite lacking network monitoring or a self-hosted server component.
C++Injection DetectionMalware AnalysisCallstack Anomaly Detection - cisco-talos/clamav
Cisco-Talos/clamav
6,869View on GitHubClamAV - Documentation is here: https://docs.clamav.net
ClamAV is a well-known open-source antivirus engine that provides signature detection and file scanning via a command-line interface, though it lacks native network monitoring.
COpen-Source Antivirus EnginesSignature-Based Threat DetectorsAntivirus Deployments - charles2gan/gda-android-reversing-tool
charles2gan/GDA-android-reversing-Tool
4,778View on GitHubThis project is a comprehensive Android reverse engineering suite that functions as a decompiler, bytecode deobfuscator, and malware analysis tool. It is designed to convert APK, DEX, and OAT binaries into human-readable source code using a native implementation that does not require a Java Virtual Machine. The platform is distinguished by its integration with Frida for dynamic analysis, allowing users to hook methods, inject custom JavaScript, and dump device memory in real time. It also features specialized security engines, including a taint propagation engine and a stack-state machine, to
This project is a comprehensive Android reverse engineering and malware analysis suite that handles static and dynamic analysis without requiring a JVM, though it focuses specifically on mobile binaries rather than a general-purpose threat detection platform.
PythonAndroid Binary DecompilersBinary DecompilationAndroid
