CobaltStrikeScan
CobaltStrikeScan scans Windows process memory for evidence of DLL injection (classic or reflective injection) and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4 beacon signatures. It can also scan a file for Cobalt Strike beacons and parse their configuration. The tool can display the beacon's configuration if detected.
FEATURES
SIMILAR TOOLS
FireEye Mandiant SunBurst Countermeasures: freely available rules for detecting malicious files and activity
A tool for navigating and annotating ATT&CK matrices with the ability to define custom layers for specific views.
In-depth threat intelligence reports and services providing insights into real-world intrusions, malware analysis, and threat briefs.
Automatic YARA rule generator based on Koodous reports with limited false positives.
GroupSense Digital Risk Protection Services provides curated threat intelligence and attack surface monitoring through their Tracelight platform to help organizations prioritize and mitigate cyber threats.
A threat intelligence domain/IP/hash threat feeds checker that checks IPVoid, URLVoid, Virustotal, and Cymon.
Facilitating exchange of information and knowledge to collectively protect against cyberattacks.
A python3 application for querying sites hosting publicly pasted data and scanning for sensitive information.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.