Halogen Logo

Halogen

0
Free
Visit Website

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing with. Currently, Halogen is able to create rules based on JPG and PNG files. Usage: halogen.py [-h] [-f FILE] [-d DIR] [-n NAME] [--png-idat] [--jpg-sos] [--jpg-sof2sos] [--jpg-jump] [-c CONTAINER] [--clam] [--rprefix RPREFIX] Halogen: Automatically create yara rules based on images embedded in office documents. Optional arguments: -h, --help show this help message and exit -f FILE, --file FILE File to parse -d DIR, --directory DIR directory to scan for image files. -n NAME, --rule-name NAME specify a custom name for the rule file --png-idat For PNG matches, instead of starting with the PNG file header, start with the IDAT chunk. --jpg-sos For JPG matches, skip over the header and look for the Start of Scan marker, and begin the match there. --jpg-sof2sos for JPG matches, skip over the header and match the SOF all the way to the SOS + 45 bytes of the data

FEATURES

ALTERNATIVES

Cortex is a tool for analyzing observables at scale and automating threat intelligence, digital forensics, and incident response.

Open Source Intelligence solution for threat intelligence data enrichment and quick analysis of suspicious files or malware.

RogueApps is a collaborative repository documenting TTPs of malicious OIDC/OAuth 2.0 applications for cybersecurity research and awareness.

Check the reputation of an IP address to identify potential threats.

Open source web app for storing and searching Actor related data from users and public repositories.

CINSscore.com provides Threat Intelligence database with accurate IP scores and collective defense through community and Sentinel IPS unit sourced data.

Converts OpenIOC v1.0 XML files into STIX Indicators, generating STIX v1.2 and CybOX v2.1 content.

A modular malware collection and processing framework with support for various threat intelligence feeds.