How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.
The main features of airbnb/binaryalert are: Detection and Classification, Detection and Hunting Tools, Development And Analysis Tools, Yara Rule Collections.
Projects with overlapping indexed features include: mitre/multiscanner — Modular file scanning/analysis framework. neo23x0/yargen — yarGen is a generator for YARA rules. emersonelectricco/fsf — File Scanning Framework. fireeye/capa — capa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities… neo23x0/loki — Loki is an endpoint detection tool, forensic artifact analyzer, and threat intelligence scanner. It functions as a… alienvault-labs/alienvaultlabs — Alienvault Labs Projects Random Stuff.
capa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities such as API calls, byte sequences, and structural patterns without executing the code. It supports multiple file formats including PE, ELF, .NET, and shellcode, and can also process runtime behavior traces from sandbox reports generated by CAPE, DRAKVUF, or VMRay. The tool integrates directly with reverse engineering environments through plugins for IDA Pro and Ghidra, allowing analysts to view capability matches and author detection rules within their disassembler of choice. C
Loki is an endpoint detection tool, forensic artifact analyzer, and threat intelligence scanner. It functions as a YARA-based indicator of compromise scanner designed to identify malicious persistence mechanisms, web shells, and unauthorized administration tools across local and remote systems. The project distinguishes itself by integrating multi-source threat intelligence, allowing for the loading of custom signature sets and encrypted indicators. It combines hash-based artifact detection with YARA rule execution to scan files, process memory, and registry hives for known malicious byte seq
