Open-source alternatives to Procfilter

Automatically generate AV byte signatures from sets of similar binaries.

MISP is an open-source threat intelligence sharing platform designed for collecting, storing, and distributing structured threat indicators and intelligence. At its core, it provides a distributed synchronization protocol for transferring events between instances, an attribute-based correlation engine that links matching indicators across events, and a REST API with an OpenAPI specification for programmatic access to threat data. The platform uses formal data formats for JSON, taxonomy, galaxy, and object templates to enable compatibility across tools and communities. The platform distinguish

Automatically create YARA rules from malicious documents.

Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o

A Yara rule generator for finding related samples and hunting

AI-assisted malware reverse-engineering debugger with ATT&CK, YARA, IOC, JSON, and analyst report output

Collaborative malware analysis framework

This project is a Python command-line security tool and malware analysis framework designed for threat intelligence aggregation and incident triage. It functions as an aggregator that orchestrates queries across multiple security services and sandboxes to analyze hashes, IP addresses, and domains. The tool distinguishes itself by incorporating an intelligence layer that uses language models to provide automated risk assessments and framework mappings. It also includes specialized capabilities for extracting indicators of compromise from unstructured text, documents, and web pages, as well as

Serverless, real-time, ClamAV+Yara scanning for your S3 Buckets

YARA Language Server

YARI is an interactive debugger for YARA Language.

Clojure YARA-style pattern matching - malware signatures, hex/ascii/regex patterns

Performs OCR on image files and scans them for matches to YARA rules

Repository that contains a set of purposefully erroneous Yara rules.

Yara integrated software to handle archive file data.

Python 3 tool to parse Yara rules (extension of yarabuilder)

A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

IDA Processor for Compiled YARA Rules

x86 emulation and shellcode detection

A Libemu Cython wrapper

A multi-platform .Net wrapper library for the native Yara library.