Rurik/Noriben

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1297 stars · 227 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Noriben is a Python script that wraps Sysinternals Procmon to automatically collect, analyze, and report runtime indicators of malware, producing a simple text report of a sample's activities. It can also be used to audit legitimate software behavior and includes an automation frontend for running samples inside a VM.

Use cases

• analyze malware behavior in a sandbox
• get a text report of what a suspicious executable did
• monitor system changes while manually running malware in a debugger
• audit what a legitimate application does to the system
• automate malware detonation inside a VM and collect reports

When to choose

• you need a lightweight, portable behavioral analysis tool on Windows
• you want to interactively run malware with custom command lines or user interaction while logging activity
• you need quick IOC extraction without setting up a full sandbox infrastructure

When to avoid

• you need large-scale automated analysis of thousands of samples
• you require network-based dynamic analysis or memory forensics
• you are not working on Windows since it depends on Sysinternals Procmon

Facets

cli-tool · maturity stable

security monitoring developer-tools security reverse-engineering windows windows python cli malware-analysis sandbox procmon incident-response behavioral-analysis

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Rurik/Noriben")