GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → PUNCH-Cyber → Stoq

PUNCH-Cyber / Stoq

Licence: apache-2.0
An open source framework for enterprise level automated analysis.

Programming Languages

python
139335 projects - #7 most used programming language

Labels

frameworkmalware-analysissecurity-automationmalware-researchyaramalware-detection

Projects that are alternatives of or similar to Stoq

Apkid
Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
Stars: ✭ 999 (+183.81%)
Mutual labels:  malware-analysis, malware-research, yara, malware-detection
Awesome Yara
A curated list of awesome YARA rules, tools, and people.
Stars: ✭ 1,394 (+296.02%)
Mutual labels:  malware-analysis, malware-research, yara, malware-detection
yara
Malice Yara Plugin
Stars: ✭ 27 (-92.33%)
Mutual labels:  malware-analysis, malware-research, yara, malware-detection
freki
🐺 Malware analysis platform
Stars: ✭ 327 (-7.1%)
Mutual labels:  malware-analysis, malware-research, yara
Nauz File Detector
Linker/Compiler/Tool detector for Windows, Linux and MacOS.
Stars: ✭ 146 (-58.52%)
Mutual labels:  malware-analysis, malware-research, malware-detection
Apkfile
Android app analysis and feature extraction library
Stars: ✭ 190 (-46.02%)
Mutual labels:  malware-analysis, malware-research, malware-detection
Drsemu
DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior
Stars: ✭ 237 (-32.67%)
Mutual labels:  malware-analysis, malware-research, malware-detection
Xapkdetector
APK/DEX detector for Windows, Linux and MacOS.
Stars: ✭ 208 (-40.91%)
Mutual labels:  malware-analysis, malware-research, malware-detection
Fame
FAME Automates Malware Evaluation
Stars: ✭ 663 (+88.35%)
Mutual labels:  framework, malware-analysis, malware-research
Malware-Sample-Sources
Malware Sample Sources
Stars: ✭ 214 (-39.2%)
Mutual labels:  malware-analysis, malware-research, malware-detection
assemblyline
AssemblyLine 4 - File triage and malware analysis
Stars: ✭ 69 (-80.4%)
Mutual labels:  malware-analysis, malware-research, malware-detection
Freki
🐺 Malware analysis platform
Stars: ✭ 285 (-19.03%)
Mutual labels:  malware-analysis, malware-research, yara
Malware Feed
Bringing you the best of the worst files on the Internet.
Stars: ✭ 69 (-80.4%)
Mutual labels:  malware-analysis, malware-research, malware-detection
MeltingPot
A tool to cluster similar executables (PEs, DEXs, and etc), extract common signature, and generate Yara patterns for malware detection.
Stars: ✭ 23 (-93.47%)
Mutual labels:  malware-research, yara, malware-detection
Drebin
Drebin - NDSS 2014 Re-implementation
Stars: ✭ 52 (-85.23%)
Mutual labels:  malware-analysis, malware-research, malware-detection
Threat Hunting
Personal compilation of APT malware from whitepaper releases, documents and own research
Stars: ✭ 219 (-37.78%)
Mutual labels:  malware-analysis, malware-research, malware-detection
Multiscanner
Modular file scanning/analysis framework
Stars: ✭ 494 (+40.34%)
Mutual labels:  malware-analysis, malware-research, yara
Yargen
yarGen is a generator for YARA rules
Stars: ✭ 795 (+125.85%)
Mutual labels:  malware-analysis, malware-research, yara
WeDefend
⛔🛡️ WeDefend - Monitor and Protect Windows from Remote Access Trojan
Stars: ✭ 23 (-93.47%)
Mutual labels:  malware-analysis, malware-research, malware-detection
binlex
A Binary Genetic Traits Lexer Framework
Stars: ✭ 303 (-13.92%)
Mutual labels:  malware-analysis, malware-research, yara
View All Similar Projects ➔


Join the community on Spectrum

Build Status Coverage Status Documentation Status Docker Build pypi License

Get Started

Overview

stoQ is an automation framework that helps to simplify the mundane and repetitive tasks an analyst is required to do. It enables analysts and DevSecOps teams to quickly transition between different data sources, databases, decoders/encoders, and numerous other tasks using enriched and consistent data structures. stoQ was designed to be enterprise ready and scalable, while also being lean enough for individual security researchers.

Why use stoQ?

  • Extremely lightweight and designed with simplicity in mind.
  • Fully supports AsyncIO.
  • A wide range of publicly available plugins.
  • stoQ makes no assumptions about your workflow. Analysts decide everything, from where data originates, how it is scanned/decoded/processed, to where it is saved.
  • Scalable in not only native/bare metal environments, but also using solutions such as Kubernetes, AWS Lambda, Google Cloud Functions, Azure Functions, and many more.
  • Written to be easily and quickly extended. All you need is a plugin.
  • Can be used in an enterprise environment or by individuals without the need for client/server infrastructure
  • Over 95% of code is covered by unittests.
  • All core functions and plugins leverage typing and are type-checked at commit.
  • Actively developed since 2011, open source since 2015.
  • Extensive up-to-date documentation.

History

stoQ was initially a collection of scripts that helped us solve problems we encountered daily. These tasks, such as parsing an SMTP session, extracting attachments, scanning them with a multitude of custom and open source tools, saving the results, and then finally analyzing them took up an increasing amount of our team's resources. We spent an ever increasing amount of time simply attempting to collect and extract data. This took valuable resources away from our ability to actually find and analyze adversaries targeting our networks.

We grew tired of being the hamster in a wheel and decided to do something about it. In 2011, we began development of a framework that would not only tackle the problem above, but also allow us to quickly change the flow of data and automated analytics, quickly pivot to new databases to house the results, and simply be able to respond to the adversaries changing their tactics, techniques, and procedures (TTPs).

Most importantly, our focus was to build a tool that would allow us to do what we love to do -- defend networks from adversaries that are determined, focused, and relentless.

In 2015, after stoQ had been matured in multiple large scale operational networks, we decided to open source our work in hopes of helping the wider Network Defense community. Since then, we've been constantly enhancing stoQ thanks to the feedback and contributions from the community of stoQ users.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].