Repositories list

• capa

  Public

  mandiant/capa’s past year of commit activity
  The FLARE team's open-source tool to identify capabilities in executable files.

  reverse-engineeringmalware-analysisbinary-analysis+ 2

  reverse-engineeringmalware-analysisbinary-analysisthreat-intelligencegsoc-2026

  Python

  •

  Apache License 2.0

  •697697 forks•6k6k stars•247247 issues•3939 pull requests•Updated Apr 23, 2026Apr 23, 2026

• harbinger

  Public

  mandiant/harbinger’s past year of commit activity
  Python

  •

  Apache License 2.0

  •1414 forks•154154 stars•00 issues•4141 pull requests•Updated Apr 23, 2026Apr 23, 2026

• STrace

  Public

  mandiant/STrace’s past year of commit activity
  A DTrace on Windows Reimplementation

  gsoc-2024

  gsoc-2024

  C++

  •

  MIT License

  •5252 forks•373373 stars•77 issues•11 pull request•Updated Apr 22, 2026Apr 22, 2026

• VM-Packages

  Public

  mandiant/VM-Packages’s past year of commit activity
  Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.

  reverse-engineeringmalware-analysischocolatey-packages+ 1

  reverse-engineeringmalware-analysischocolatey-packagesflare

  PowerShell

  •

  Apache License 2.0

  •9494 forks•222222 stars•103103 issues•55 pull requests•Updated Apr 22, 2026Apr 22, 2026

• gopacket

  Public

  mandiant/gopacket’s past year of commit activity
  Gopacket is a clean Go implementation of Impacket, a library intended for working with network protocols.

  Go

  •

  Apache License 2.0

  •4040 forks•537537 stars•11 issue•00 pull requests•Updated Apr 22, 2026Apr 22, 2026

• flare-floss

  Public

  mandiant/flare-floss’s past year of commit activity
  FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

  stringsmalwaredeobfuscation+ 3

  stringsmalwaredeobfuscationmalware-analysisflaregsoc-2026

  Python

  •

  Apache License 2.0

  •526526 forks•4k4k stars•9797 issues•1717 pull requests•Updated Apr 22, 2026Apr 22, 2026

• macos-UnifiedLogs

  Public

  mandiant/macos-UnifiedLogs’s past year of commit activity
  A cross platform parser for Apple UnifiedLogs!

  macosrustapple+ 2

  macosrustappleforensicsdfir

  Rust

  •

  Apache License 2.0

  •4444 forks•340340 stars•55 issues•22 pull requests•Updated Apr 22, 2026Apr 22, 2026

• ADFSpoof

  Public

  mandiant/ADFSpoof’s past year of commit activity
  Python

  •

  Apache License 2.0

  •6969 forks•410410 stars•22 issues•77 pull requests•Updated Apr 21, 2026Apr 21, 2026

• xrefer

  Public

  mandiant/xrefer’s past year of commit activity
  FLARE Team's Binary Navigator

  reverse-engineeringida-promalware-analysis+ 5

  reverse-engineeringida-promalware-analysisbinary-analysisidapythonthreat-intelligenceidaplugingsoc-2026

  Python

  •

  Apache License 2.0

  •4444 forks•317317 stars•99 issues•44 pull requests•Updated Apr 17, 2026Apr 17, 2026

• Vulnerability-Disclosures

  Public

  mandiant/Vulnerability-Disclosures’s past year of commit activity
  C++

  •6969 forks•220220 stars•00 issues•00 pull requests•Updated Apr 16, 2026Apr 16, 2026

• dncil

  Public

  mandiant/dncil’s past year of commit activity
  The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.

  Python

  •

  Apache License 2.0

  •1919 forks•172172 stars•22 issues•33 pull requests•Updated Apr 13, 2026Apr 13, 2026

• gocrack-ui

  Public

  mandiant/gocrack-ui’s past year of commit activity
  The User Interface for GoCrack

  fireeye-flare

  fireeye-flare

  Vue

  •

  MIT License

  •5050 forks•8989 stars•00 issues•3737 pull requests•Updated Apr 10, 2026Apr 10, 2026

• speakeasy

  Public

  mandiant/speakeasy’s past year of commit activity
  Windows kernel and user mode emulation.

  emulationmalware-analysis

  emulationmalware-analysis

  Python

  •

  MIT License

  •282282 forks•1.9k1.9k stars•1010 issues•22 pull requests•Updated Apr 8, 2026Apr 8, 2026

• capa-testfiles

  Public

  mandiant/capa-testfiles’s past year of commit activity
  Data to test capa's code and rules.

  Max

  •

  Apache License 2.0

  •8484 forks•4747 stars•00 issues•44 pull requests•Updated Apr 3, 2026Apr 3, 2026

• flare-fakenet-ng

  Public

  mandiant/flare-fakenet-ng’s past year of commit activity
  FakeNet-NG - Next Generation Dynamic Network Analysis Tool

  malware-analysistraffic-redirectionfakenet-ng+ 2

  malware-analysistraffic-redirectionfakenet-ngmandiant-flaregsoc-2026

  Python

  •

  Apache License 2.0

  •379379 forks•2.1k2.1k stars•6060 issues•2222 pull requests•Updated Apr 2, 2026Apr 2, 2026

• vcsa-hardening-tool

  Public

  mandiant/vcsa-hardening-tool’s past year of commit activity
  Automated Zero Trust hardening and forensic auditing for VMware vCenter Server Appliance (VCSA)

  Shell

  •00 forks•1010 stars•00 issues•00 pull requests•Updated Apr 2, 2026Apr 2, 2026

• capa-rules

  Public

  mandiant/capa-rules’s past year of commit activity
  Standard collection of rules for capa: the tool for enumerating the capabilities of programs

  Apache License 2.0

  •235235 forks•711711 stars•120120 issues•1818 pull requests•Updated Apr 1, 2026Apr 1, 2026

• flare-learning-hub

  Public

  mandiant/flare-learning-hub’s past year of commit activity
  Free educational content on reverse engineering and malware analysis from the FLARE team

  cgogolang+ 13

  cgogolangassemblyx64reverse-engineeringmalwarecybersecurityassembly-languagex86+ 6

  JavaScript

  •

  Apache License 2.0

  •7474 forks•1.1k1.1k stars•00 issues•00 pull requests•Updated Mar 31, 2026Mar 31, 2026

• PwnAuth

  Public

  mandiant/PwnAuth’s past year of commit activity
  Python

  •

  Apache License 2.0

  •9696 forks•399399 stars•22 issues•1111 pull requests•Updated Mar 25, 2026Mar 25, 2026

• flare-vm

  Public

  mandiant/flare-vm’s past year of commit activity
  A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.

  reverse-engineeringmalware-analysisflare

  reverse-engineeringmalware-analysisflare

  PowerShell

  •

  Apache License 2.0

  •1.1k1.1k forks•8.6k8.6k stars•2020 issues•77 pull requests•Updated Mar 20, 2026Mar 20, 2026

• stringsifter

  Public

  mandiant/stringsifter’s past year of commit activity
  A machine learning tool that ranks strings based on their relevance for malware analysis.

  machine-learningstringsreverse-engineering+ 4

  machine-learningstringsreverse-engineeringlearning-to-rankmalware-analysisfireeye-flarefireeye-data-science

  Python

  •

  Apache License 2.0

  •127127 forks•753753 stars•88 issues•55 pull requests•Updated Mar 11, 2026Mar 11, 2026

• GoReSym

  Public

  mandiant/GoReSym’s past year of commit activity
  Go symbol recovery tool

  gsoc-2026

  gsoc-2026

  Go

  •

  MIT License

  •104104 forks•969969 stars•99 issues•11 pull request•Updated Mar 6, 2026Mar 6, 2026

• flare-floss-testfiles

  Public
  Resources for testing FLOSS by the FLARE team.

  C

  •2121 forks•77 stars•00 issues•00 pull requests•Updated Mar 5, 2026Mar 5, 2026

• flare-gsoc

  Public
  Supporting resources and documentation for FLARE @ Google Summer of Code 2026

  Apache License 2.0

  •1212 forks•5050 stars•00 issues•00 pull requests•Updated Feb 2, 2026Feb 2, 2026

• gootloader

  Public

  mandiant/gootloader’s past year of commit activity
  Collection of scripts used to deobfuscate GOOTLOADER malware samples.

  deobfuscationgootloader

  deobfuscationgootloader

  Python

  •

  Apache License 2.0

  •99 forks•7777 stars•11 issue•00 pull requests•Updated Dec 29, 2025Dec 29, 2025

• vrt-sdk

  Public

  mandiant/vrt-sdk’s past year of commit activity
  Python

  •

  Apache License 2.0

  •33 forks•11 star•00 issues•00 pull requests•Updated Nov 24, 2025Nov 24, 2025

• gocrack

  Public
  GoCrack is a management frontend for password cracking tools written in Go

  fireeye-flare

  fireeye-flare

  Go

  •

  MIT License

  •237237 forks•1.3k1.3k stars•1818 issues•1010 pull requests•Updated Nov 19, 2025Nov 19, 2025

• brickstorm-scanner

  Public

  mandiant/brickstorm-scanner’s past year of commit activity
  Shell

  •1313 forks•8383 stars•22 issues•11 pull request•Updated Nov 14, 2025Nov 14, 2025

• cleanldap

  Public
  C

  •

  Apache License 2.0

  •1212 forks•186186 stars•00 issues•00 pull requests•Updated Oct 21, 2025Oct 21, 2025

• commando-vm

  Public
  Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com

  windowspenetration-testingred-teaming+ 1

  windowspenetration-testingred-teamingfireeye-flare

  PowerShell

  •

  Apache License 2.0

  •1.3k1.3k forks•7.6k7.6k stars•66 issues•22 pull requests•Updated Oct 16, 2025Oct 16, 2025