sf

stoQ is a automation framework that helps to simplify the to a greater extent than mundane in addition to repetitive tasks an analyst is required to do. It allows analysts in addition to DevSecOps teams the mightiness to chop-chop transition from dissimilar information sources, databases, decoders/encoders, in addition to numerous other tasks. stoQ was designed to move company produce in addition to scalable, spell likewise beingness thin plenty for private safety researchers. Want to acquire more? Read but about of the blog posts we've written to acquire more. Introduction to stoQ stoQ in addition to Enterprise e-mail Operationalizing Indicators stoQ amongst Suricata Plugins stoQ currently has over twoscore publicly available plugins. These plugins are available separately inwards the plugin repository Installation in addition to Documenation Want to boot the bucket started quickly? Check out the docker image . stoQ requires a minimum of python 3.4. Instal...

Fnord is a designing extractor for obfuscated code Description Fnord has ii original functions: Extract byte sequences together with exercise to a greater extent than or less statistics Use these statistics, combine length, release of occurrences, similarity together with keywords to exercise a YARA rule 1. Statistics Fnord processes the file amongst a sliding window of varying size to extract all sequences of amongst a minimum length -m X (default: 4) upwards to a maximum length -x X (default: 40). For each length, Fnord volition introduce the close ofttimes occurring sequences -t X (default: 3) inward a table. Each business inward the tabular array contains: Length Number of occurrences Sequence (string) Formatted (ascii/wide/hex) Hex encoded form Entropy 2. YARA Rule Creation Fnord also generates an experimental YARA rule. During YARA dominion creation it volition calculate a marking based inward the length of the sequence together with the release of occ...

SilkETW is a flexible C# wrapper for ETW , it is meant to abstract away the complexities of ETW as well as hand people a unproblematic interface to perform interrogation as well as introspection. While SilkETW has obvious defensive (and offensive) applications it is primarily a interrogation tool inwards it's electrical current state. For slow consumption, output information is serialized to JSON. The JSON information tin either live analyzed locally using PowerShell or shipped off to tertiary political party infrastructure such every bit Elasticsearch . Implementation Details Libraries SilkETW is buit on .Net v4.5 as well as uses a disclose of tertiary political party libraries, every bit shown below. Please run across LICENSE-3RD-PARTY for farther details. ModuleId Version LicenseUrl -------- ------- ---------- ...