#1Tools for managing, sharing, and integrating Indicators of Compromise (IOCs) into security defenses.
Kitploit recommended
duggytuxy/data-shield_ipv4_blocklistCurated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…
thomaspoppelgaard/netscaler-ctx697096-checkerRead-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778): verifies build, CVE preconditions and upgrade risks, and sweeps public IoCs…
cisagov/kev-dataMirrors CISA's Known Exploited Vulnerabilities (KEV) catalog as CSV and JSON with a JSON schema, enabling programmatic access and commit-history…
misp/misp-galaxyClusters and elements to attach to MISP events or attributes (like threat actors)
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
cisagov/vulnrichmentA repo to conduct vulnerability enrichment.
julioliraup/antiphishingAdvanced Phishing Protection: Suricata rulesets open and free
fazmin/cve-intelLocal security intelligence for CVE triage - 39 data sources and 36 tools, risk scores and an MCP server for AI agents, all in native Rust. Private…
toborrm9/malicious_extension_sentryMalicious Extension Database
opencti-platform/openctiOpen Cyber Threat Intelligence Platform
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
log2timeline/plasoDigital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…
threatray/threat-researchIoCs and YARA rules from Threatray's Threat Research
essexrich/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…
mvt-project/mvtForensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…
drb-ra/c2intelfeedsAutomatically generated C2 threat intelligence feeds of IPs, domains, URL paths, and implant configuration metadata, derived from internet scanning…
canonical/ubuntu-security-noticesUbuntu vulnerability dataset publishing USN/LSN security notices in OSV and OpenVEX JSON formats for automated vulnerability and VEX-aware dependency…
