Trellix Advanced Research Center

All

21 repositories

GhidraScripts
Public
Scripts to run within Ghidra, maintained by the Trellix ARC team
Java
•
Apache License 2.0
•7•90•0•0•Updated Sep 19, 2024Sep 19, 2024
BSim
Public
BSim signatures and databases for Ghidra to recover function symbols with
Apache License 2.0
•0•2•0•0•Updated Jul 11, 2024Jul 11, 2024
Golang-Runtime-Binaries
Public
A repository with a variety of compiled Golang binaries, each of which contains the entire Golang runtime for the given architecture for the specific Golang version
Apache License 2.0
•1•2•0•0•Updated Jun 27, 2024Jun 27, 2024
FIDBs
Public
FunctionID databases for Ghidra to recover function symbols with from stripped binaries
Apache License 2.0
•0•3•0•0•Updated Jun 19, 2024Jun 19, 2024
Yara-Rules
Public
Repository of YARA rules made by Trellix ATR Team
threat-hunting iocs yara threat-intelligence
YARA
•
Apache License 2.0
•80•570•1•0•Updated Dec 21, 2023Dec 21, 2023
DotDumper
Public
An automatic unpacker and logger for DotNet Framework targeting files
dotnet malware automatic unpacking
C#
•
Other
•28•250•0•0•Updated Aug 23, 2023Aug 23, 2023
DotDumperGUI
Public
A graphical user interface to easily read through, and filter, DotDumper JSON-based logs
C#
•
Apache License 2.0
•0•6•0•0•Updated May 11, 2023May 11, 2023
DotDumperNative
Public
The native (unmanaged) library which contains hooks for native functions that are hooked using DotDumper
C++
•
Apache License 2.0
•0•2•0•0•Updated May 11, 2023May 11, 2023
NetLlix
Public
A project created with an aim to emulate and test exfiltration of data over different network protocols.
C#
•
Other
•7•30•0•1•Updated Mar 21, 2023Mar 21, 2023
Creosote
Public
Creosote is our solution to searching for the tarfile vulnerability described by CVE-2007-4559.
Python
•
Other
•14•83•3•2•Updated Sep 23, 2022Sep 23, 2022
Expert-Rules
Public
threat-detection security
Apache License 2.0
•3•17•0•1•Updated May 31, 2022May 31, 2022
Russian_CyberThreats_Yara
Public
Repository with aggregated public source yara rules
1•2•0•0•Updated Mar 2, 2022Mar 2, 2022
ATR_HAX_CTF_2022
Public
Trellix Advanced Threat Research CTF compitition of 2022
Java
•
GNU General Public License v3.0
•2•5•0•0•Updated Feb 28, 2022Feb 28, 2022
ATR_HAX_CTF_2021
Public
McAfee Enterprise Advanced Threat Research Capture the Flag
Python
•4•8•0•0•Updated Feb 26, 2022Feb 26, 2022
DarkSide-Config-Extract
Public
reverse-engineering ransomware
10•33•0•0•Updated Oct 29, 2021Oct 29, 2021
IOCs
Public
Repository containing IOCs, CSV and MISP JSON from our blogs
HTML
•17•78•1•0•Updated Aug 4, 2021Aug 4, 2021
Ripple-20-Detection-Logic
Public
Ripple20 Critical Vulnerabilities - Detection Logic and Signatures
lua ipv6 rce suricata atr cve mcafee suricata-rule tcpip-stack ripple20
Lua
•4•11•0•0•Updated May 28, 2021May 28, 2021
CVE-2020-16898
Public
CVE-2020-16898 (Bad Neighbor) Microsoft Windows TCP/IP Vulnerability Detection Logic and Rule
microsoft windows-10 rce suricata atr cve neighbor-discovery buffer-overflow mcafee neighbor-discovery-protocol
Lua
•31•207•0•0•Updated Oct 26, 2020Oct 26, 2020
CVE-2020-16899
Public
CVE-2020-16899 - Microsoft Windows TCP/IP Vulnerability Detection Logic and Rule
microsoft lua windows-10 rce suricata atr cve neighbor-discovery buffer-overflow mcafee
Lua
•9•21•0•0•Updated Oct 19, 2020Oct 19, 2020
xbypass
Public
A tool to facilitate ROP Chain Development for XML Character Sanitization
Python
•
Other
•7•18•2•0•Updated May 9, 2019May 9, 2019
Threat-Reports
Public
Repository to store the Threat Reports made by the McAfee Enterprise ATR Team
2•10•0•0•Updated Oct 11, 2018Oct 11, 2018