MANDIANT

All

101 repositories

harbinger
Public
Python
•
Apache License 2.0
•14•150•0•28•Updated Mar 21, 2026Mar 21, 2026
capa
Public
The FLARE team's open-source tool to identify capabilities in executable files.
reverse-engineering malware-analysis binary-analysis
reverse-engineering malware-analysis binary-analysis threat-intelligence gsoc-2026
Python
•
Apache License 2.0
•682•5.9k•231•38•Updated Mar 20, 2026Mar 20, 2026
flare-floss
Public
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
strings malware deobfuscation
strings malware deobfuscation malware-analysis flare gsoc-2026
Python
•
Apache License 2.0
•525•3.9k•97•26•Updated Mar 20, 2026Mar 20, 2026
flare-vm
Public
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
reverse-engineering malware-analysis flare
reverse-engineering malware-analysis flare
PowerShell
•
Apache License 2.0
•1.1k•8.5k•20•7•Updated Mar 20, 2026Mar 20, 2026
VM-Packages
Public
Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.
reverse-engineering malware-analysis chocolatey-packages
reverse-engineering malware-analysis chocolatey-packages flare
PowerShell
•
Apache License 2.0
•96•220•107•8•Updated Mar 20, 2026Mar 20, 2026
ADFSpoof
Public
Python
•
Apache License 2.0
•69•409•2•6•Updated Mar 17, 2026Mar 17, 2026
PwnAuth
Public
Python
•
Apache License 2.0
•96•398•2•11•Updated Mar 17, 2026Mar 17, 2026
dncil
Public
The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.
Python
•
Apache License 2.0
•19•171•2•5•Updated Mar 16, 2026Mar 16, 2026
capa-rules
Public
Standard collection of rules for capa: the tool for enumerating the capabilities of programs
Apache License 2.0
•227•702•120•16•Updated Mar 12, 2026Mar 12, 2026
STrace
Public
A DTrace on Windows Reimplementation
gsoc-2024
gsoc-2024
C++
•
MIT License
•51•372•7•0•Updated Mar 12, 2026Mar 12, 2026
speakeasy
Public
Windows kernel and user mode emulation.
emulation malware-analysis
emulation malware-analysis
Python
•
MIT License
•282•1.9k•25•18•Updated Mar 12, 2026Mar 12, 2026
stringsifter
Public
A machine learning tool that ranks strings based on their relevance for malware analysis.
machine-learning strings reverse-engineering
machine-learning strings reverse-engineering learning-to-rank malware-analysis fireeye-flare fireeye-data-science
Python
•
Apache License 2.0
•129•754•8•5•Updated Mar 11, 2026Mar 11, 2026
gocrack-ui
Public
The User Interface for GoCrack
fireeye-flare
fireeye-flare
Vue
•
MIT License
•50•88•0•37•Updated Mar 11, 2026Mar 11, 2026
Vulnerability-Disclosures
Public
C++
•69•216•0•0•Updated Mar 9, 2026Mar 9, 2026
macos-UnifiedLogs
Public
A cross platform parser for Apple UnifiedLogs!
macos rust apple
macos rust apple forensics dfir
Rust
•
Apache License 2.0
•43•336•5•1•Updated Mar 8, 2026Mar 8, 2026
GoReSym
Public
Go symbol recovery tool
gsoc-2026
gsoc-2026
Go
•
MIT License
•103•954•8•5•Updated Mar 6, 2026Mar 6, 2026
flare-floss-testfiles
Public
Resources for testing FLOSS by the FLARE team.
C
•21•7•0•0•Updated Mar 5, 2026Mar 5, 2026
xrefer
Public
FLARE Team's Binary Navigator
reverse-engineering ida-pro malware-analysis
reverse-engineering ida-pro malware-analysis binary-analysis idapython threat-intelligence idaplugin gsoc-2026
Python
•
Apache License 2.0
•42•314•9•5•Updated Feb 23, 2026Feb 23, 2026
capa-testfiles
Public
Data to test capa's code and rules.
Max
•
Apache License 2.0
•83•47•0•5•Updated Feb 17, 2026Feb 17, 2026
flare-gsoc
Public
Supporting resources and documentation for FLARE @ Google Summer of Code 2026
Apache License 2.0
•10•46•0•0•Updated Feb 2, 2026Feb 2, 2026
gootloader
Public
Collection of scripts used to deobfuscate GOOTLOADER malware samples.
deobfuscation gootloader
deobfuscation gootloader
Python
•
Apache License 2.0
•9•77•1•0•Updated Dec 29, 2025Dec 29, 2025
flare-fakenet-ng
Public
FakeNet-NG - Next Generation Dynamic Network Analysis Tool
malware-analysis traffic-redirection fakenet-ng
malware-analysis traffic-redirection fakenet-ng mandiant-flare gsoc-2026
Python
•
Apache License 2.0
•377•2.1k•62•24•Updated Dec 9, 2025Dec 9, 2025
vrt-sdk
Public
Python
•
Apache License 2.0
•3•1•0•0•Updated Nov 24, 2025Nov 24, 2025
gocrack
Public
GoCrack is a management frontend for password cracking tools written in Go
fireeye-flare
fireeye-flare
Go
•
MIT License
•240•1.3k•18•10•Updated Nov 19, 2025Nov 19, 2025
brickstorm-scanner
Public
Shell
•14•82•2•1•Updated Nov 14, 2025Nov 14, 2025
cleanldap
Public
C
•
Apache License 2.0
•12•177•0•0•Updated Oct 21, 2025Oct 21, 2025
commando-vm
Public
Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com
windows penetration-testing red-teaming
windows penetration-testing red-teaming fireeye-flare
PowerShell
•
Apache License 2.0
•1.3k•7.5k•6•2•Updated Oct 16, 2025Oct 16, 2025
vrt-auto
Public
Python
•
Apache License 2.0
•3•1•0•0•Updated Aug 29, 2025Aug 29, 2025
flare-emu
Public
emulation malware-analysis fireeye-flare
emulation malware-analysis fireeye-flare
Python
•
Apache License 2.0
•143•934•5•1•Updated Aug 14, 2025Aug 14, 2025
poisonplug-scatterbrain
Public
Deobfuscation library for PoisionPlug.SHADOW's ScatterBrain obfuscator
Python
•
Apache License 2.0
•10•81•0•0•Updated Mar 14, 2025Mar 14, 2025