4 repository-uri
Awesome GitHub RepositoriesCapability Analyzers
Scans binaries to catalog functional capabilities such as code execution, data exfiltration, and anti-analysis techniques.
Distinct from Malware Analysis: Distinct from Malware Analysis: focuses on cataloging what a binary can do (capabilities) rather than general reverse engineering or behavioral analysis.
Explore 4 awesome GitHub repositories matching security & cryptography · Capability Analyzers. Refine with filters or upvote what's useful.
Awesome Capability Analyzers GitHub Repositories
Găsește cele mai bune repo-uri cu AI.Vom căuta cele mai potrivite repository-uri folosind AI.
- mandiant/capa
mandiant/capa
6,062Vezi pe GitHubcapa is a binary capability scanner that identifies high-level behaviors and actions an executable can perform, such as network communication or file manipulation. It functions as a malware behavior analysis tool and a MITRE ATT&CK mapping framework, scanning PE, ELF, .NET, and shellcode files through both static analysis and dynamic sandbox report processing. The tool distinguishes itself through a YAML-based detection rule engine that defines detection logic in human-readable files, with conditions expressed as feature combinations and logical operators. It integrates with IDA Pro, Ghidra,
Scans binaries to catalog functional capabilities such as code execution, data exfiltration, and anti-analysis techniques.
Python - fireeye/capa
fireeye/capa
6,062Vezi pe GitHubcapa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities such as API calls, byte sequences, and structural patterns without executing the code. It supports multiple file formats including PE, ELF, .NET, and shellcode, and can also process runtime behavior traces from sandbox reports generated by CAPE, DRAKVUF, or VMRay. The tool integrates directly with reverse engineering environments through plugins for IDA Pro and Ghidra, allowing analysts to view capability matches and author detection rules within their disassembler of choice. C
Scans PE, ELF, .NET, and shellcode files to identify what a program can do using static analysis rules.
Python - mantvydasb/redteaming-tactics-and-techniques
mantvydasb/RedTeaming-Tactics-and-Techniques
4,620Vezi pe GitHubThis project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi
Provides tools to analyze malware binaries and catalog capabilities such as data exfiltration and anti-analysis techniques.
PowerShelloffensive-securityoscppentesting - rpisec/malware
RPISEC/Malware
4,028Vezi pe GitHubThis project is a cybersecurity educational resource and courseware designed for malware analysis and reverse engineering. It provides a structured curriculum of lessons, labs, and guided projects focused on detecting and understanding the behavior of malicious software. The resource includes a lab guide for building isolated virtual machine environments to safely execute and study malware. It covers the setup of a specialized toolchain consisting of disassemblers and debuggers used to analyze compiled machine code. The training material covers both static analysis, which examines binary cod
Offers guided projects for detecting and understanding the behavior of real-world encrypted malware samples.
