cylance Goto Github PK

ablation

Ablation is a tool for augmenting static analysis by extracting information at runtime, and importing it into IDA. It can resolve virtual calls, reveal interesting code, exclude heavily traversed regions, identify untested or undocumented features, visually diff samples, or perform root cause analysis simply by running samples. My favourite however is the virtual call resolution with fully interactive x-refs. It's simple, elegant, and disassembled C++ reads like C! It helps me time and time again.

amazon-athena-cross-account-catalog

🌉 Reference implementation for granting cross-account AWS Glue Data Catalog access from Amazon Athena

cloud-custodian

Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources

cybot

Open Source Threat Intelligence Chat Bot

cylr

CyLR - Live Response Collection Tool

cyshell

A Powershell module to interface with Cylance APIs

ebpf_processor

An IDA processor for eBPF bytecode

generalizedconvolutionalneuralnets

Generalized convolutional neural network algorithm for use with point cloud data with arbitrary spatial features.

getnetguids

Extract GUIDs from .NET assemblies

googleauthdotnet

A dot net based Google Authenticator Client - suitable for use in a windows environment

idpanel

Identify botnet panels with Ensembled Decision Trees

improving-malware-detection-accuracy-by-extracting-icon-information

Code for the paper "Improving Malware Detection Accuracy by Extracting Icon Information"

introductiontomachinelearningforsecuritypros

Example code for our book Introduction to Artificial Intelligence for Security Professionals

iocs

lazy-stochastic-principal-component-analysis

Code for the paper "Lazy stochastic principal component analysis"

macos-arm64-emulation

A guide for emulating macOS arm64e on an x86-based host.

markovobfuscate

Use Markov Chains to obfuscate data as other data

mitmcanary

Tool/service to detect Man in the Middle attacks with Canary Requests

nmap-cluster

Clustering NMAP XML results to help make sense of large scan results.

perturbed-sequence-model

petastorm

Petastorm library enables single machine or distributed training and evaluation of deep learning models from datasets in Apache Parquet format. It supports ML frameworks such as Tensorflow, Pytorch, and PySpark and can be used from pure Python code.

prangster

Black-Box Assessment of Pseudorandom Algorithms

pypackerdetect

A malware dataset curation tool which helps identify packed samples.

python-cyapi

This Library provides python bindings to interact with the Cylance API.

recon2016

BBS-Era Exploitation for Fun and Anachronism

rogers

Python command-line tool that uses nearest neighbor search methods for malware similarity analysis

smart_open

Utils for streaming large files (S3, HDFS, gzip, bz2...)

smbtrap

Tools developed to test the Redirect to SMB issue

talus

talus_client