artifacts
practical outputs, tools, and experiments
purpose
curated yara rules for detecting emerging threats and custom malware families. supplements public rule sets with private signatures.
statistics
127 rules, last updated: 2025-04-15
purpose
demonstrates exploitation technique for cve-2025-16847 (libpng heap overflow). includes heap grooming primitives and controlled write primitive.
technical details
- crafted png with malformed itxt chunks - heap grooming via spray of controlled allocations - overwrites vtable pointer for arbitrary code execution - bypasses aslr via infoleak in preceding chunk
tested on
ubuntu 22.04, fedora 38, debian 12
usage
python buffer-overflow-poc.py target.png [offset] [address]
purpose
tool for analyzing and decoding custom cobalt strike malleable c2 profiles. extracts configuration and identifies evasion techniques.
output
json configuration, yara rule generation
purpose
controlled laboratory environment for testing and understanding process injection techniques. includes implementations of common methods for defensive research.
environment
isolated vm, instrumentation with frida
notes
documents detection opportunities and edr telemetry patterns for each technique.
purpose
custom forensic memory analysis framework built for rapid incident response. automates extraction of common artifacts from windows memory dumps.
capabilities
- process list with command line arguments
- network connections and listening ports
- kernel objects: mutexes, events, semaphores
- credential extraction from lsass
- clipboard contents and typed history
- unallocated space carving for deleted files
architecture
written in rust for performance and memory safety. plugins system for extensible artifact extraction. supports raw memory dumps and crash dumps.
dependencies
volatility3 plugins, winpmem driver
purpose
lightweight dns sinkhole for blocking malicious domains and collecting intelligence on dns-based malware communication patterns.
features
- real-time domain reputation checking
- feeds integration from multiple threat intel sources
- query logging with metadata (ip, timestamp, query type)
- whitelist for internal domains
- api for automation and integration
environment
containerized, supports bind and coredns backends
purpose
automated malware analysis sandbox for dynamic behavior observation. captures system interactions and generates comprehensive reports.
capabilities
- file system: creation, deletion, modification
- registry: keys, values, persistence mechanisms
- network: connections, dns queries, data transfer
- process: creation, termination, injection
- mutex and named pipe creation
- anti-analysis and anti-debugging checks
output
json report, pcaps, screenshots, memory dumps, extracted strings
purpose
minimal api hooking framework for intercepting windows api calls. useful for both defensive monitoring and understanding offensive techniques.