Owner

mandiant

21 indexed repositories · View on GitHub

flare-vm
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering env...

PowerShell · 9052 stars
commando-vm
Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mand...

PowerShell · 7808 stars
capa
The FLARE team's open-source tool to identify capabilities in executable files.

Python · 6190 stars
flare-floss
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

Python · 4154 stars
flare-fakenet-ng
FakeNet-NG - Next Generation Dynamic Network Analysis Tool

Python · 2201 stars
speakeasy
Windows kernel and user mode emulation.

Python · 2053 stars
gocrack
GoCrack is a management frontend for password cracking tools written in Go

Go · 1287 stars
GoReSym
Go symbol recovery tool

Go · 1092 stars
flare-emu

Python · 955 stars
stringsifter
A machine learning tool that ranks strings based on their relevance for malware analysis.

Python · 763 stars
capa-rules
Standard collection of rules for capa: the tool for enumerating the capabilities of programs

736 stars
gopacket
A complete Go port of Impacket - 63 CLI tools and 24 libraries for Windows & Active Directory protocol attacks, compiled to a single depe...

Go · 708 stars
ADFSpoof

Python · 426 stars
PwnAuth

Python · 402 stars
STrace
A DTrace on Windows Reimplementation

C++ · 379 stars
macos-UnifiedLogs
A cross platform parser for Apple UnifiedLogs!

Rust · 376 stars
xrefer
FLARE Team's Binary Navigator

Python · 322 stars
VM-Packages
Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.

PowerShell · 246 stars
dncil
The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.

Python · 179 stars
brickstorm-scanner

Shell · 89 stars
1 more repository lives on View on GitHub

Beginner friendly Everything

Open All

A lot more anti-panicking code Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

mandiant/macos-UnifiedLogs#161 · Opened Sep 15, 2026
fix hook bugs Open

good first issue

Difficulty 4/5 3-5 days Newbie friendliness 30/100

mandiant/speakeasy#323 · Opened Sep 14, 2026
Weird 0xAAAA_AAAA EUID, perhaps worth documenting or acknowledging as Option::None Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

mandiant/macos-UnifiedLogs#159 · Opened Sep 10, 2026
auto build string dbs from capa rules Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

mandiant/flare-floss#1429 · 1 reaction · Opened Sep 7, 2026
elffile: crash with `RuntimeError: generator raised StopIteration` when a relocation table tag lacks its companion size or entry-size tag Open

Difficulty 3/5 1-2 days Newbie friendliness 78/100

mandiant/capa#3171 · Opened Sep 7, 2026
elffile: crash with `ValueError: max() iterable argument is empty` when `DT_GNU_HASH` points at a removed `.gnu.hash` section Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

mandiant/capa#3170 · Opened Sep 6, 2026
Static Extraction: String Fragmentation & RVA Overflow Mapping Mismatches Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

mandiant/flare-floss#1425 · 2 comments · Opened Sep 4, 2026
qs: consider tagging debug info strings or sections Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

mandiant/flare-floss#1420 · 1 reaction · Opened Sep 2, 2026
Prep for v0.7.0 Release Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

mandiant/macos-UnifiedLogs#158 · 19 comments · Opened Sep 1, 2026
Use Idalib instead of lancelot Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

mandiant/flare-floss#1408 · Opened Aug 27, 2026
Housekeeping: audit of stale feature branches Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

mandiant/flare-floss#1406 · 2 comments · Opened Aug 25, 2026
viewer: add basic tests (lint/build in CI + smoke test) Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

mandiant/flare-floss#1402 · Opened Aug 24, 2026
Decide the default string-deobfuscation behavior (all vs. static-only opt-in) Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

mandiant/flare-floss#1379 · Opened Aug 19, 2026
[encrypt data using RC4 PRGA] False positive on string validators Open

false positive

Difficulty 4/5 3-5 days Newbie friendliness 45/100

mandiant/capa-rules#1193 · Opened Aug 19, 2026
Version bump for the QS release + backward-compat aliases for --only/--no Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

mandiant/flare-floss#1378 · 1 comment · Opened Aug 19, 2026
Viewer: tag filter should support include/exclude + neutral state, or an AND/OR mode switch Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

mandiant/flare-floss#1377 · Opened Aug 19, 2026
Fix 10 correctness/regression issues found in review of #1372 before merging QUANTUMSTRAND into master Open

QS

mandiant/flare-floss#1375 · 4 comments · 1 assignee · Opened Aug 18, 2026
Consider Rust or Go reimplementation of at least static extraction, layout, and tagging Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

mandiant/flare-floss#1374 · Opened Aug 18, 2026
Serve the web viewer from the standalone FLOSS binary Open

enhancement QS/ui

Difficulty 4/5 3-5 days Newbie friendliness 55/100

mandiant/flare-floss#1371 · 5 comments · Opened Aug 18, 2026
Cache key does not cover analysis options Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

mandiant/flare-floss#1369 · 2 comments · Opened Aug 18, 2026
Docs: revisit what to keep vs. filter during rendering (tags, cache, options) Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

mandiant/flare-floss#1368 · Opened Aug 18, 2026
tree-sitter: fit script constants and attributes into existing feature set Open

enhancement gsoc question tree-sitter

mandiant/capa#3158 · 2 comments · 1 assignee · Opened Aug 17, 2026
Feature Request: Token-efficient --llm output mode for AI agent consumption Open

Difficulty 5/5 Over a week Newbie friendliness 45/100

mandiant/flare-floss#1365 · 1 reaction · Opened Aug 17, 2026
Enhancement: Tagging, filtering, and summary features fail for unstructured files Open

Difficulty 3/5 1-2 days Newbie friendliness 64/100

mandiant/flare-floss#1364 · Opened Aug 17, 2026
Profile test performance and improve it Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

mandiant/flare-floss#1363 · 1 comment · Opened Aug 17, 2026
Track CLI option/string-type interaction complexity from iteration 4 review Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

mandiant/flare-floss#1362 · Opened Aug 16, 2026
`hide graphical window from taskbar` declares dynamic: call but requires a mnemonic on every path Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

mandiant/capa-rules#1191 · 1 comment · Opened Aug 15, 2026
elffile.py:181 yields Arch("arm"), which is not in VALID_ARCH Open

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

mandiant/capa#3155 · 1 comment · Opened Aug 15, 2026
open VM devices Open

rule idea

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

mandiant/capa-rules#1188 · Opened Aug 14, 2026
check heap flags Open

rule idea

Difficulty 4/5 3-5 days Newbie friendliness 38/100

mandiant/capa-rules#1187 · Opened Aug 14, 2026
FP: BeingDebugged flag due to offset by register Open

false negative

Difficulty 3/5 1-2 days Newbie friendliness 45/100

mandiant/capa-rules#1182 · 1 comment · Opened Aug 14, 2026
check for analysis tools listening on a local port Open

rule idea

Difficulty 2/5 1-3 hours Newbie friendliness 64/100

mandiant/capa-rules#1181 · 1 comment · Opened Aug 14, 2026
FP: check for time delay via GetTickCount Open

false positive

Difficulty 3/5 1-2 days Newbie friendliness 48/100

mandiant/capa-rules#1180 · 1 comment · Opened Aug 14, 2026
Profile performance and improve before release Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

mandiant/flare-floss#1361 · 1 reaction · Opened Aug 14, 2026
triage PATCHCORD malware for new capa rules Open

rule idea

Difficulty 4/5 3-5 days Newbie friendliness 42/100

mandiant/capa-rules#1176 · 1 comment · Opened Aug 14, 2026
tree-sitter: enable CI to verify scripts contain proper guards Open

CI enhancement gsoc tree-sitter

Difficulty 3/5 1-2 days Newbie friendliness 65/100

mandiant/capa#3153 · 2 comments · Opened Aug 13, 2026
tree-sitter: extract string features at file scope Open

enhancement gsoc tree-sitter

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

mandiant/capa#3152 · Opened Aug 13, 2026
tree-sitter: support UTF-16 and UTF-8 encodings Open

bug gsoc tree-sitter

Difficulty 4/5 3-5 days Newbie friendliness 58/100

mandiant/capa#3149 · 1 comment · Opened Aug 12, 2026
tree-sitter: add usage and extension documentation Open

documentation gsoc tree-sitter

mandiant/capa#3148 · 1 comment · 1 assignee · Opened Aug 12, 2026
tree-sitter: add support for Bash scripts Open

enhancement gsoc tree-sitter

mandiant/capa#3147 · 1 comment · 1 assignee · Opened Aug 12, 2026
tree-sitter: protobuf output incomplete Open

bug gsoc tree-sitter

mandiant/capa#3146 · 1 assignee · Opened Aug 12, 2026
floss run without args - show shorter help output Open

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

mandiant/flare-floss#1359 · Opened Aug 12, 2026
testfiles: consider reevaluating all files to ensure runtime requirement is met Open

CI enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

mandiant/capa#3141 · 2 comments · Opened Aug 11, 2026
Update Go and Rust global prevalence databases with a larger data set Open

QS

Difficulty 4/5 3-5 days Newbie friendliness 35/100

mandiant/flare-floss#1357 · Opened Aug 11, 2026
Create .NET specific global prevalence database Open

QS

Difficulty 5/5 Over a week Newbie friendliness 25/100

mandiant/flare-floss#1356 · Opened Aug 11, 2026
fix(ghidra): generated import script fails Python parsing Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

mandiant/flare-floss#1351 · 1 reaction · Opened Aug 8, 2026
Golden Gate and iOS 27 tests Open

Difficulty 3/5 1-2 days Newbie friendliness 54/100

mandiant/macos-UnifiedLogs#148 · Opened Aug 8, 2026
DCE/RPC bind_ack presentation-context result is never checked, so rejected binds look successful Open

Difficulty 4/5 3-5 days Newbie friendliness 57/100

mandiant/gopacket#45 · 1 comment · 1 reaction · Opened Aug 4, 2026
Review LogData default values Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

mandiant/macos-UnifiedLogs#144 · 1 reaction · Opened Aug 3, 2026
Detect QEMU VM Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

mandiant/flare-vm#751 · Opened Aug 1, 2026

Showing the newest 100

This page lists what was indexed most recently. Advanced filter has the whole inventory, narrowed by language, difficulty and how long a task takes.

Open advanced filter

mandiant

Showing the newest 100

Get new issues in your inbox