Various public documents, whitepapers and articles about APT campaigns

https://github.com/kbandla/APTnotes

Standard Windows processes: a brief reference

https://www.andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/

Analyzing Metasploit Payloads

https://hatching.io/blog/metasploit-payloads/

Simple windows API logger

https://github.com/d35ha/xLogger

Dalvik opcodes

http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html

VBA Stomping - Advanced Maldoc Techniques

https://medium.com/walmartlabs/vba-stomping-advanced-maldoc-techniques-612c484ab278

Ghidra Extension to integrate BinDiff for function matching

https://github.com/ubfx/BinDiffHelper

DynamoRIO

DynamoRIO is a runtime code manipulation system that supports code transformations on any part of a program, while it executes. DynamoRIO exports an interface for building dynamic tools for a wide variety of uses: program analysis and understanding, profiling, instrumentation, optimization, translation, etc.

https://github.com/DynamoRIO/dynamorio

emerald
Import DynamoRIO drcov code coverage data into Ghidra

https://github.com/reb311ion/emerald

sysmon-modular

a sysmon configuration repository for everybody to customise

https://github.com/olafhartong/sysmon-modular

sysmon-config

a sysmon configuration file for everybody to fork

https://github.com/SwiftOnSecurity/sysmon-config

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

https://github.com/yampelo/beagle

capa detects capabilities in executable files. You run it against a PE file or shellcode and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.

https://github.com/fireeye/capa