Florian Roth

A Simple Ransomware Vaccine

YARA signature and IOC database for my scanners and tools

A YARA rule generator

🐍 High-performance, multi-threaded YARA & IOC scanner

Loki - Simple IOC and YARA Scanner

Best Practice Auditd Configuration

yarGen is a generator for YARA rules

Online hash checker for Virustotal and other services

Simple Bash IOC Scanner

Detector for Log4Shell exploitation attempts

Yara Rule Analyzer and Statistics

Awesome VirusTotal Intelligence Search Queries

Pattern Extractor for Obfuscated Code

A list of my personal projects

A guide on how to write fast and memory friendly YARA rules

Smart DLL execution for malware analysis in sandbox systems

God Mode Detection Rules

YARA rule analyzer to improve rule quality and performance

Log Entry to Sigma Rule Converter

Detection Script for MongoBleed Exploitation

PE Import Hash Generator

Browser Shortcuts for Cyber Security Related Online Services

Sandbox feature upgrade with the help of wrapped samples

A specification and style guide for YARA rules

All kinds of tiny shells

A YARA Rule Performance Measurement Tool

Slides of my public talks

Leak File Analyzer

Immediate Virus Infection Counter Measures

Cybersecurity's lighter side: a collection of the most amusing misunderstandings and missteps from newcomers to offensive security tools. A repository where naiveté in infosec is met with humor.

A collection of typical false positive indicators

XOR Key Extractor

Scan web server for known webshell names and responses

Recipes for GCHQ's CyberChef Web App

A harmless Netcat-lookalike for detection testing. Simulates NC-style command-line flags and listener behavior without exposing a real backdoor or shell.

LittleSnitch Log Statistics Exporter

An Inofficial Sysmon Version History (Change Log)

A curated list of awesome YARA rules, tools, and people.

Offensive Research Guide to Help Defense Improve Detection

Scanner for the SkeletonKey Malware

Command Line STDOUT Colorer

Aggregated SHA-256 and SHA-1 checksums for Notepad++ release assets - collected from official GitHub release checksum files.

Scanner for Regin Virtual Filesystems

Knowledge base of analytics designed to cover threats based on MITRE's ATT&CK.

Tools and Techniques for Blue Team / Incident Response

Invisible Watermarks with Space Characters in ASCII Files

Some IR notes

Windows Syslog Command Line Client

A tool that adds reproducible UUIDs to YARA rules

Spy Agency Teasing

A harmless cryptocurrency miner simulator for detection testing. Generates realistic mining-like artifacts without consuming resources or connecting to actual pools.

Some YARA rules i will add from time to time

Yara rules for malware families seen as part of targeted threats project

Wordpress Watcher is a wrapper for WPScan that manages scans on multiple sites and reports by email

The pattern matching swiss knife

Ideas for projects for defensive research or blue teaming

Repository of yara rules

The best way to scan for weak ssh passwords on your network

Repository of Yara Rules

Indicators of Compromises (IOC) of our various investigations

This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins.

Stop Windows 10 Nagging and Spying. Works with Win7-10

a small tool for investigating inline hooks (and other in-memory code patches)

Repository of YARA rules made by McAfee Enterprise ATR Team

A tool to spread canary credentials in your organisation

Collection of hacks that make use of the least available on victim systems

A neon-drenched terminal UI for MoltBot with Tamagotchi vibes. Live monitoring, 10 themes, and a robot that talks back.

No description.

Signatures and IoCs from public Volexity blog posts.

A Python package to interact with the Mitre ATT&CK Framework

Kaspersky's GReAT KLara

Parse YARA rules and operate over them more easily.

Python Script to access ATT&CK content available in STIX via a public TAXII server

Standalone Executable to Check for Simple Privilege Escalation Vectors on Windows Systems

A not so awesome list of malware gems for aspiring malware analysts

Splunk Add-on for PowerShell provides field extraction for PowerShell event logs.

Exploit the credentials present in files and memory

My collection of nmap NSE scripts

GRR Rapid Response: remote live forensics for incident response

A repository of sysmon configuration modules

Lightweight macOS baseline checks - collect config signals and send them as JSON to your SIEM

(Demo) - Only used to demonstrate a memory leak caused by Golang regexp

Six Degrees of Domain Admin

Extended Splunk Alert Manager with advanced reporting on alerts, workflows (modify assignee, status, severity) and auto-resolve features

Tweaks password files to match modern password requirements

Python library using the MISP Rest API

A PowerShell TCP/IP swiss army knife.

yet another general purpose naive bayesian classifier.

Syntax Theme for THOR APT Scanner log files

Deleting Shadow Copies In Pure C++

IOC from articles, tweets for archives

The Python programming language

No description.

Transform Linux Audit logs for SIEM usage

CLI tool for open source and threat intelligence

TheHive: a Scalable, Open Source and Free Incident Response Platform

No description.

SunBurst DGA Decode Script

No description.

Pyminifier is a Python code minifier, obfuscator, and compressor.

Miscellaneous projects related to attacking Windows.

random powershell goodness

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

AI agent skill for VirusTotal API v3 — query hashes, investigate IOCs, search VT Intelligence, and manage YARA Livehunt/Retrohunt

AI agent skill to generate YARA rules from malware samples using yarGen-Go. Manages goodware databases, supports CLI and API for rule generation, and integrates with yarGen web server. Use when generating YARA rules, managing goodware databases, creating custom string/opcode databases, or interacting with yarGen web API.

Collection of my own detection rules

No description.

Venom is a library that meant to perform evasive communication using stolen browser socket

No description.

Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway [ CVE-2019-19781 ]

PoC Exploit for CVE-2018-0802 (and optionally CVE-2017-11882)

Cortex Analyzers Repository

No description.

A light-weight first-stage C2 implant written in Nim.

A tool to dump the login password from the current linux user

A flexible and lightweight way to execute LOKI on end systems

WannaCryToolkit scanner and removal toolkit

Divoom timebox CLI utility

RedPeanut is a small RAT developed in .Net Core 2 and its agent in .Net 3.5 / 4.0.

Golang port of pefile

Open Threat Exchange is an open community that allows participants to learn about the latest threats, research indicators of compromise observed in their environments, share threats they have identified, and automatically update their security infrastructure with the latest indicators to defend their environment.

Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

Parse Yara rules and operate over them more easily.

Malware Configuration And Payload Extraction

This repository contains analysis scripts, YARA rules, and additional IoCs related to the blog post "Let’s set ice on fire: Hunting and detecting IcedID infections".

Random sigma rules to share with the community

Rules Shared by the Community from 100 Days of YARA 2023

Detection in the form of Yara, Snort and ClamAV signatures.

Exploit for Arbitrary File Read on Pulse Secure SSL VPN (CVE-2019-11510)

python parser for human readable dates

No description.

Nim-based assembly packer and shellcode loader for opsec & profit

All the deals for InfoSec related software/tools this Black Friday

Information regarding publicly discussed vulnerabilities

Golang API client for GRR Rapid Response

a network packet capture compiler

Cross-platform C2 implant framework. Every TTP ships with YARA rules, Sigma rules, and IR playbooks.

cve-2021-21985 exploit

Databases used in yarGen

THOR Thunderstorm Collectors

IOCs from Google Threat Intelligence Group

KittyStager is a simple stage 0 C2. It is made of a web server to host the shellcode and an implant, called kitten. The purpose of this project is to be able to have a web server and some kitten and be able to use the with any shellcode.

No description.

No description.

ALFA-SHELL-V2.5.3

Collection of YARA signatures from individual research

Tools and scripts by Arctic Wolf

A collection of my yara rules

Imphash Generator

Go bindings for YARA

Cross-platform, open-source shellbag parser

No description.

🚧 Currently transfering TLP:CLEAR rules from TLP:AMBER repository...

No description.

Elastic Security detection content for Endpoint

The Token Stealer