How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
Al-Khaser is a research project focused on the development of anti-analysis and evasion techniques to resist reverse engineering. It provides implementations for detecting and evading virtual machines, sandboxes, and debuggers to prevent software analysis. The project implements control flow obfuscation through anti-disassembly methods and utilizes dynamic API resolution to bypass static import tables. It further hinders forensic analysis by manipulating memory headers to prevent process dumps and utilizing remote code injection to execute logic in external processes. The capability surface
Identifies the bytes that Microsoft Defender flags on.
pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes. The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade
Behavior based monitoring and hunting tool built in C# leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons.
The main features of hegusung/avsignseek are: Blue Team Tools, Malware Analysis.
Projects with overlapping indexed features include: matterpreter/defendercheck — Identifies the bytes that Microsoft Defender flags on. lordnoteworthy/al-khaser — Al-Khaser is a research project focused on the development of anti-analysis and evasion techniques to resist reverse… hasherezade/pe-sieve — pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode,… 3lp4tr0n/beaconhunter — Behavior based monitoring and hunting tool built in C# leveraging ETW tracing. Blue teamers can use this tool to… activecm/rita — Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through… accidentalrebel/mbcscan.