This code repository offers downloads for the latest images of various DevTerm models, as well as kernel patches, keyboard firmware, the source code for screen and printer drivers, hardware schemat…

Generate YARA rules for OOXML documents.

Synapse Central Intelligence System

A tool to help malware analysts signature unique parts of RTF documents

A set of Zeek scripts to detect ATT&CK techniques.

Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings

Indicators from Unit 42 Public Reports

Sample queries for Advanced hunting in Microsoft 365 Defender

YARA signature and IOC database for my scanners and tools

A Yara rule generator for finding related samples and hunting

a collection of yara rules for binary analysis

A domain name parser to parse and to validate a domain name.

Javascript library for browser to S3 multipart resumable uploads

PEAS is a Python 2 library and command line application for running commands on an ActiveSync server e.g. Microsoft Exchange.

A VBA parser and emulation engine to analyze malicious macros.

typeahead.js is a fast and fully-featured autocomplete library

Loki - Simple IOC and YARA Scanner

Dropzone is an easy to use drag'n'drop library. It supports image previews and shows nice progress bars.

A simple string hashmap in C

C macros for hash tables and more

Lightweight, portable and easy to integrate C directory and file reader

Various public documents, whitepapers and articles about APT campaigns

Basic implementations of standard cryptography algorithms, like AES and SHA-1.

Libewf is a library to access the Expert Witness Compression Format (EWF)

CryptoSwift is a growing collection of standard and secure cryptographic algorithms implemented in Swift

Binary analysis and management framework

Cuckoo Sandbox is an automated dynamic malware analysis system

The pattern matching swiss knife

Library and tools to access the OLE 2 Compound File (OLECF) format

Web Starter Kit - a workflow for multi-device websites