deepinstinct Goto Github PK

amsi-unchained

Unchain AMSI by patching the provider’s unmonitored memory space

containyourself

A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.

conti-research

Full details of the research can be found on our blog page

demotet

Unpacking and decryption tools for the Emotet malware

dirty-vanity

A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.html#dirty-vanity-a-new-approach-to-code-injection--edr-bypass-28417

dsc_fix

Aids in reverse engineering libraries from dyld_shared_cache in IDA

ducktail_iocs

DuckTail campaign IOCs

emotet-iocs

Emotet IOCs of the new wave in 2023

exceller

Replaces VBA cells function calls with their content, to make the VBA code less obfuscated and easier to detect by AV vendors.

israel-cyber-warfare-threat-actors

Updated Repository for the Cyber Community Regarding Cyber Threats Affecting Israel

jar-polyglot-poc

A simple PoC of a polyglot HTML + JAR file.

lnkmaker-iocs

LnkMaker used by APT37 - IOCs

lsass-shtinkering

lsasssilentprocessexit

Command line interface to dump LSASS memory to disk via SilentProcessExit

mach-o

moveit_cve-2023-34362_iocs

CVE-2023-34362-IOCs. More information on Deep Instinct's blog site.

nofilter

nsisextractor

Extract the original ransomware binary from an NSIS installer

phonyc2-muddywater-research

MuddyWater C2 framework research

pindos-js-dropper

JS dropper used recently for Bumblebee and IcedID infection

rattyconfigextractor

A python script that extracts the "command & control" server address from Ratty malware

rusty-flag-decryptdata

A tool to decrypt the information sent by the Rusty Flag malware to the C2

storm0978-romcom-campaign

Recent Campaign abusing CVE-2023-36884

uac-0099-targeting_ua

UAC-0099 is a threat actor that targets Ukraine since mid-2022

vsto-poc

A proof-of-concept created for academic/learning purposes, demonstrating both local and remote use of VSTO "Add-In's" maliciously