Halogen Logo

Halogen

0
Free
Visit Website

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing with. Currently, Halogen is able to create rules based on JPG and PNG files. Usage: halogen.py [-h] [-f FILE] [-d DIR] [-n NAME] [--png-idat] [--jpg-sos] [--jpg-sof2sos] [--jpg-jump] [-c CONTAINER] [--clam] [--rprefix RPREFIX] Halogen: Automatically create yara rules based on images embedded in office documents. Optional arguments: -h, --help show this help message and exit -f FILE, --file FILE File to parse -d DIR, --directory DIR directory to scan for image files. -n NAME, --rule-name NAME specify a custom name for the rule file --png-idat For PNG matches, instead of starting with the PNG file header, start with the IDAT chunk. --jpg-sos For JPG matches, skip over the header and look for the Start of Scan marker, and begin the match there. --jpg-sof2sos for JPG matches, skip over the header and match the SOF all the way to the SOS + 45 bytes of the data

FEATURES

ALTERNATIVES

A Linux distribution designed for threat emulation and threat hunting, integrating attacker and defender tools for identifying threats in your environment.

Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data.

A set of rules for detecting threats in various formats, including Snort, Yara, ClamAV, and HXIOC.

Repository of APT-related documents and notes sorted by year.

A library of Amazon S3 attack scenarios with mitigation strategies.

A threat intelligence and vulnerability monitoring platform that aggregates security alerts from trusted sources and provides customizable monitoring and notification capabilities.

A parsing tool for Yara Scan Service's JSON output file to help maximize benefits and automate parsing of Yara Scan Service results.

Freely available network IOCs for monitoring and incident response

PINNED