g0mxxm Goto Github PK

infosec_reference

iocs

Sophos-originated indicators-of-compromise from published reports

iocs-idps

This repository will hold PCAP IOC data related with known malware samples (owner: Bryant Smith)

jlaive

.NET Antivirus Evasion Tool (Exe2Bat)

jlaive-1

Antivirus evasion tool (crypter) that converts executables into undetectable batch files.

jlaive_crypter

🔰 Crypter 100% FUD AntiVirus Evasion | AES-256, XOR Bit Encryption

kernel-process-hollowing

Windows x64 kernel mode rootkit process hollowing POC.

knowledgebase

Collection of tips, tools, arsenal and techniques I've learned during RE and other CyberSecStuff

kql

Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.

lexiconaugmentedner

Reject complicated operations for incorporating lexicon for Chinese NER.

limon

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

literature_review

Survey of program analysis research with a focus on machine code

ll-rasp

Low-level RASP: Protecting Applications Implemented in High-level Programming Languages

llvmanalyzer

笔者在一款基于LLVM编译器架构的retdec开源反编译器工具的基础上,融合了klee符号执行工具,通过符号执行(Symbolic Execution)引擎动态模拟反编译后的llvm的ir(中间指令集)运行源程序的方法,插桩所有的对x86指令集的thiscall类型函数对this指针结构体(也就是rcx寄存器,简称this结构)偏移量引用,经行分析汇总后自动识别this结构体的具体内容,并自动集成导入ida工具辅助分析.

lopqto.github.io

Personal blog

malware

malware-1

Malware source code samples leaked online uploaded to GitHub for those who want to analyze the code.

malware_analysis

The scripts were ctreated and used by myself in malware analysis.

malwaresourcecode

Collection of malware source code for a variety of platforms in an array of different programming languages.

mua-remote-control-trojan

MUA远控木马

netripper

NetRipper - Smart traffic sniffing for penetration testers

othf

Open Threat Hunting Framework

pastehunter

Scanning pastebin with yara rules

pe-bear-releases

PE-bear (builds only)

picture

This is a picture repository of vscode picgo

polichombr

Collaborative malware analysis framework

process-dump

Windows tool for dumping malware PE files from memory back to disk for analysis.

processinjection

Some ways to inject a DLL into a alive process

protections-artifacts

Elastic Security detection content for Endpoint

protectors

🛡️ Obfuscator, Encryption, Junkcode, Anti-Debug, PE protection/modification