Halogen Logo

Halogen

0
Free
Visit Website

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing with. Currently, Halogen is able to create rules based on JPG and PNG files. Usage: halogen.py [-h] [-f FILE] [-d DIR] [-n NAME] [--png-idat] [--jpg-sos] [--jpg-sof2sos] [--jpg-jump] [-c CONTAINER] [--clam] [--rprefix RPREFIX] Halogen: Automatically create yara rules based on images embedded in office documents. Optional arguments: -h, --help show this help message and exit -f FILE, --file FILE File to parse -d DIR, --directory DIR directory to scan for image files. -n NAME, --rule-name NAME specify a custom name for the rule file --png-idat For PNG matches, instead of starting with the PNG file header, start with the IDAT chunk. --jpg-sos For JPG matches, skip over the header and look for the Start of Scan marker, and begin the match there. --jpg-sof2sos for JPG matches, skip over the header and match the SOF all the way to the SOS + 45 bytes of the data

FEATURES

ALTERNATIVES

Public access to Indicators of Compromise (IoCs) and other data for readers of Security Scorecard's technical blog posts and reports.

Open Source Intelligence solution for threat intelligence data enrichment and quick analysis of suspicious files or malware.

Automatic YARA rule generator based on Koodous reports with limited false positives.

A repository to aid Windows threat hunters in looking for common artifacts.

Lists of sources and utilities to hunt, detect, and prevent evildoers.

Freely available network IOCs for monitoring and incident response

Analyze suspicious files, domains, IPs, and URLs to detect malware and other breaches, and share results with the security community.

RedEye is a visual analytic tool for enhancing Red and Blue Team operations.