Projects sharing features with Malice

Malware Configuration And Payload Extraction

Sandboxed Execution Environment

Noriben - Portable, Simple, Malware Analysis Sandbox

A Tool for Automatic Analysis of Malware Behavior

Pikachu is a web security training platform and vulnerable web application sandbox. It provides a containerized lab environment designed for practicing penetration testing and identifying common security flaws. The project serves as an OWASP Top 10 practice lab, offering a simulation suite for critical risks. It includes specific scenarios for practicing the exploitation of SQL injection, cross-site scripting, remote code execution, and broken access control. The environment covers a broad range of security testing simulations, including directory traversal, server-side request forgery, unsa

Katoolin is a Debian software repository manager and security toolset automator. It functions as a script to automate the addition of repositories and the installation of security tools from Kali Linux onto other Debian-based systems. The project focuses on automating the deployment of penetration testing and forensics software. It provides a method for managing third-party software sources and provisioning security labs with tools for network and system testing without requiring a full operating system installation. The tool includes an interactive command line interface for navigating tool

DetectIQ is an AI-powered security rule management platform that helps create, analyze, and optimize detection rules across multiple security platforms. It can be used with the provided UI, or just with Python scripts using the self contained detectiq/core module. See examples in the examples…

Repository containing IOCs, CSV and MISP JSON from our blogs

DFIR LABS is a compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.

Collection of android malware samples

Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis. The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns witho

OpenWEC is a free and open source (GPLv3) implementation of a Windows Event Collector server running on GNU/Linux and written in Rust.

APTnotes data

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

Fast Incident Response

IR drill plateform

Contributed by Check Point Software Technologies LTD. Programmed by Yaraslau Harakhavik

Lynis is an automated security auditing and system hardening framework designed for UNIX-based operating systems. It functions as a command-line utility that inspects local system configurations to identify security vulnerabilities, configuration weaknesses, and compliance gaps. By executing a series of modular tests, the tool generates actionable reports and remediation suggestions to assist in strengthening system defenses. The project distinguishes itself through a highly modular architecture that relies on shell-script-based execution and native system inspection. Users can define custom

A tool for studying JavaScript malware.