Open-source alternatives to Halogen

Extract and aggregate threat intelligence.

A YARA-integrated process denial framework for Windows

Kaspersky's GReAT KLara

This project is a Python command-line security tool and malware analysis framework designed for threat intelligence aggregation and incident triage. It functions as an aggregator that orchestrates queries across multiple security services and sandboxes to analyze hashes, IP addresses, and domains. The tool distinguishes itself by incorporating an intelligence layer that uses language models to provide automated risk assessments and framework mappings. It also includes specialized capabilities for extracting indicators of compromise from unstructured text, documents, and web pages, as well as

A Yara rule generator for finding related samples and hunting

AI-assisted malware reverse-engineering debugger with ATT&CK, YARA, IOC, JSON, and analyst report output

Collaborative malware analysis framework

Serverless, real-time, ClamAV+Yara scanning for your S3 Buckets

YARI is an interactive debugger for YARA Language.

A multi-platform .Net wrapper library for the native Yara library.

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

YARA Language Server

Clojure YARA-style pattern matching - malware signatures, hex/ascii/regex patterns

Performs OCR on image files and scans them for matches to YARA rules

Repository that contains a set of purposefully erroneous Yara rules.

Yara integrated software to handle archive file data.

Python 3 tool to parse Yara rules (extension of yarabuilder)

A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

IDA Processor for Compiled YARA Rules

x86 emulation and shellcode detection

A Libemu Cython wrapper

Parsing of YARA rules into AST and building new rulesets in C++.