{"id":51015078,"url":"https://github.com/securityronin/exec-pe-forensic","last_synced_at":"2026-06-21T09:02:43.905Z","repository":{"id":365137190,"uuid":"1263697834","full_name":"SecurityRonin/exec-pe-forensic","owner":"SecurityRonin","description":"PE (Windows executable) forensic analyzer — pe-core parses PE32/PE64 headers (sections, imports, entropy); pe-analysis grades MITRE-tagged anomalies (suspicious imports, packing/entropy, process-injection IOCs)","archived":false,"fork":false,"pushed_at":"2026-06-16T02:12:52.000Z","size":119,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-16T04:11:47.082Z","etag":null,"topics":["dfir","forensics","incident-response","malware-analysis","mitre-attack","packer-detection","pe","portable-executable","rust","rust-forensics","security","windows"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-09T07:27:22.000Z","updated_at":"2026-06-16T02:12:55.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/exec-pe-forensic","commit_stats":null,"previous_names":["securityronin/exec-pe-forensic"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/exec-pe-forensic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fexec-pe-forensic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fexec-pe-forensic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fexec-pe-forensic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fexec-pe-forensic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/exec-pe-forensic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fexec-pe-forensic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34603647,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-21T02:00:05.568Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dfir","forensics","incident-response","malware-analysis","mitre-attack","packer-detection","pe","portable-executable","rust","rust-forensics","security","windows"],"created_at":"2026-06-21T09:02:38.991Z","updated_at":"2026-06-21T09:02:43.894Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"[![Crates.io](https://img.shields.io/crates/v/exec-pe-core.svg)](https://crates.io/crates/exec-pe-core)\n[![Docs.rs](https://img.shields.io/docsrs/exec-pe-core)](https://docs.rs/exec-pe-core)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n[![CI](https://github.com/SecurityRonin/exec-pe-forensic/actions/workflows/ci.yml/badge.svg)](https://github.com/SecurityRonin/exec-pe-forensic/actions)\n[![Sponsor](https://img.shields.io/badge/sponsor-h4x0r-pink)](https://github.com/sponsors/h4x0r)\n\n**Parse a Windows PE binary and get MITRE-tagged forensic detections in three lines of Rust.**\n\n```rust\nuse exec_pe_core::parser::parse_pe_path;\nuse exec_pe_analysis::detect_all;\n\nlet pe = parse_pe_path(\"suspicious.exe\")?;\nfor hit in detect_all(\u0026pe) {\n    println!(\"[{}] {} — {}\", hit.mitre_technique_id, hit.tactic, hit.description);\n}\n```\n\n```\n[T1027.002] defense-evasion — Packed/protected section 'UPX0' (entropy 7.82, known packer name)\n[T1055]     defense-evasion — Suspicious API import: 'VirtualAllocEx'\n[T1055]     defense-evasion — Suspicious API import: 'WriteProcessMemory'\n[T1055]     defense-evasion — Suspicious API import: 'CreateRemoteThread'\n[T1486]     impact          — QWCrypt/RedCurl IOC '.qwCrypt' found in PE string table\n[T1562.001] defense-evasion — AV exclusion fragment 'Windows Defender\\Exclusions' found in PE string table\n```\n\n---\n\n## What it detects\n\n| Detection | MITRE ID | Confidence | Signal |\n|-----------|----------|------------|--------|\n| Suspicious API imports | T1055 / T1134 | High | `VirtualAllocEx`, `WriteProcessMemory`, `CreateRemoteThread`, `BCryptEncrypt`, `ShellExecuteW`, raw Winsock, 55+ more |\n| Packed / protected binary | T1027.002 | High | UPX, MPRESS, Themida, VMProtect, Enigma section names **or** Shannon entropy ≥ 6.8 |\n| PE structural anomalies | T1027 | Medium–High | W+X sections, EP outside sections, virtual-only sections, large virtual/raw ratio, absent Rich header |\n| Overlay data | T1027.009 | High | Bytes appended after the last section — dropper/second-stage channel |\n| TLS callbacks | T1055.005 | High | Callbacks executing before the PE entry point — anti-debug staging area |\n| Anti-debug API imports | T1622 | Medium | `IsDebuggerPresent`, `NtQueryInformationProcess`, `QueryPerformanceCounter`, `FindWindowA`, timing checks, 25+ more |\n| Process hollowing cluster | T1055.012 | High | ≥ 3 of: `NtUnmapViewOfSection`, `WriteProcessMemory`, `SetThreadContext`, `VirtualAllocEx`, `ResumeThread`, 8 more |\n| Network / C2 strings | T1071.001 | Medium | `http://`, `https://`, `.onion`, `User-Agent:`, `/beacon`, `/implant`, `meterpreter`, `reverse_tcp`, 15+ more |\n| Persistence strings | T1547.001 | High | `CurrentVersion\\Run`, `Winlogon\\Userinit`, `schtasks /create`, WMI event filters, `AppInit_DLLs`, COM `InprocServer32` |\n| Ransomware strings | T1486 | High | `.wncry`, `.locked`, `HOW_TO_DECRYPT`, `bitcoin`, `monero`, `.onion`, `YOUR_FILES_ARE_ENCRYPTED`, 20+ more |\n| Credential / secret strings | T1552.001 | High | `password=`, `api_key=`, `AKIA` (AWS key prefix), `-----BEGIN`, `Authorization: Bearer`, JWT prefix, DB connection strings |\n| .NET anomalies | T1027 | Medium | Managed binary with native TLS callbacks or overlay — mixed-mode loader / dropper pattern |\n| AV exclusion strings | T1562.001 | Medium | Defender, Kaspersky, McAfee, Sophos, ESET, Bitdefender registry path fragments |\n| QWCrypt / RedCurl IOCs | T1486 | High | `.qwCrypt`, `rbcw`, `excludeVM`, `ZAM64`, `zamguard`, `workers.dev` |\n\nDetections are sorted by MITRE technique ID — output is deterministic and diff-friendly across runs.\n\n---\n\n## Install\n\n```toml\n[dependencies]\nexec-pe-core     = \"0.1\"\nexec-pe-analysis = \"0.1\"\n```\n\nThe two crates are intentionally separate. `exec-pe-core` is a zero-IO, medium-agnostic parser: it accepts `\u0026[u8]` or a file path and returns a `PeFile` struct. `exec-pe-analysis` contains the detectors; they are pure functions over `\u0026PeFile` with no I/O of their own. You can use `exec-pe-core` alone if you only need structured PE metadata.\n\n---\n\n## What you get from `PeFile`\n\n```rust\npub struct PeFile {\n    pub machine: u16,            // 0x8664 AMD64 | 0x014C x86 | 0xAA64 ARM64\n    pub compile_timestamp: u32,  // COFF timestamp — frequently zeroed or faked\n    pub is_dll: bool,\n    pub is_exe: bool,\n    pub imports: Vec\u003cString\u003e,    // all imported symbol names\n    pub exports: Vec\u003cString\u003e,    // exported symbol names (DLLs)\n    pub sections: Vec\u003cPeSection\u003e,\n    pub ascii_strings: Vec\u003cString\u003e,   // printable ASCII runs ≥ 6 chars\n    pub utf16_strings: Vec\u003cString\u003e,   // UTF-16LE runs ≥ 6 chars\n    pub sha256: String,          // hex-encoded SHA-256 of the full binary\n    pub size: usize,\n}\n\npub struct PeSection {\n    pub name: String,\n    pub virtual_size: u32,\n    pub raw_size: u32,\n    pub virtual_address: u32,\n    pub entropy: f32,            // Shannon entropy 0.0 – 8.0\n    pub is_executable: bool,\n    pub is_writable: bool,\n    pub is_readable: bool,\n}\n```\n\n---\n\n## Architecture\n\n```\nexec-pe-forensic\n├── exec-pe-core        PARSER layer — accepts \u0026[u8] or Path, no CONTAINER/FS dependencies\n│   ├── parser     goblin::pe::PE → PeFile struct (imports, sections, strings, SHA-256)\n│   └── strings    extract_ascii / extract_utf16le / compute_entropy\n└── exec-pe-analysis    detectors — pure fn(\u0026PeFile) -\u003e Vec\u003cPeDetection\u003e\n    ├── suspicious_imports   SUSPICIOUS_IMPORT_NAMES from forensicnomicon\n    ├── packed               PACKED_SECTION_NAMES + entropy threshold\n    ├── av_exclusion         AV_EXCLUSION_PATH_FRAGMENTS from forensicnomicon\n    └── ioc                  QWCRYPT_PE_STRING_IOCS from forensicnomicon\n```\n\nFormat constants and IOC lists live in [`forensicnomicon`](https://github.com/SecurityRonin/forensicnomicon) — a zero-dependency, compile-time knowledge crate. Updating an IOC list means bumping `forensicnomicon`, not touching any parsing logic.\n\n---\n\n## 66 tests, strict TDD\n\nEvery detector was written test-first (red commit before green). Real corpus validation supplements the unit suite.\n\n```\ncargo test\n```\n\n---\n\n[Privacy Policy](https://securityronin.github.io/exec-pe-forensic/privacy/) · [Terms of Service](https://securityronin.github.io/exec-pe-forensic/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fexec-pe-forensic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Fexec-pe-forensic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fexec-pe-forensic/lists"}