sentinelabs Goto Github PK

aeon

Repository containing Aeon Timeline templates and example projects

aevt_decompile

This is a work-in-progress command line tool for reversing run-only AppleScripts. It will help parse the output of applescript-disassembler.py into something more human-readable.

alphagolang

IDApython Scripts for Analyzing Golang Binaries

aoqin_dragon

cl0p-elf-decryptor

Python3 script which decrypts files encrypted by flawed Cl0p ELF variant.

crypt1_iocs

Massive unpacking of CryptOne samples

enumerate-macos-loginitems

Xcode Playground that will return a list of all installed applications for a user that use SMLoginItem API

gamaredon-apt

This is a collection of relevant indicators of compromise for the main blog.

gootloader-iocs-q1-2021

900 SHA1 Gootloader js loader hashes plus some of the most relevant lures with the embedded URLs used for the delivery of the payloads.

hotpatch-for-apache-log4j2

An agent to hotpatch the log4j RCE from CVE-2021-44228.

iocs

A Collection of IOC's

log4j_response

macos-ttps-yara

A ruleset to find potentially malicious code in macOS malware samples

memloader

Memory Loader Open Source Project by Sentinel-Labs.

meteor-express

Hashes and Yara hunting rules for MeteorExpress Wiper

moveit-iis-log-scanner

A simple script to scan IIS logs for potential exploitation of MOVEit

powertrick

This is a repository for the public blog with Labs indicators of compromise and code

r2pipe-stringdecoder

s1ql-queries

sentinellabs_revcore_tools

The Windows Malware Analysis Reversing Core Tools

shadowpad

Technical Indicators for SentinelLabs ShadowPad research

solarwinds_countermeasures

This tool is designed to identify processes, services, and drivers that SUNBURST attempts to identify on the victim's machine.

trickbot-anchor

This is a repository for the public blog with Labs indicators of compromise.

trickbot-deobfuscator

Code and data related to TrickBot-Deobfuscator blog

vtgrepghidra

xprotect-malware-families

Mapping XProtect's obfuscated malware family names to common industry names.

yara

Public SentinelLabs Yara Rules

zloader-2021

IOCs for ZLoader Campaign 2021