#1Tools for managing, sharing, and integrating Indicators of Compromise (IOCs) into security defenses.
Kitploit recommended
jonathanstross/cve-2025-31324A Python-based security scanner for identifying the CVE-2025-31324 vulnerability in SAP Visual Composer systems, and detecting known Indicators of…
zedocun/sharepoint-toolshell-cve-2025-53770-incident-analysisTechnical analysis of a SharePoint ToolShell (CVE-2025-53770) exploitation attempt involving RCE, webshell deployment, and MachineKey extraction.
ma1am/cve-2022-26134-exploit-detectionThis repository contains Yara rule and the method that a security investigator may want to use for CVE-2022-26134 threat hunting on their Linux…
b401/clickstudio-compromised-certificateRepository containing the compromised certificate seen in recent CVE-2022-30190 (Follina) attacks.
ngvcanh/cve-2025-55182-attack-analysisReal-world attack analysis of CVE-2025-55182 (React2Shell) - React Server Components RCE vulnerability
rxerium/honeypot🍯Honeypot Threat Intel
zedocun/soc-investigation-powershell-edrfreezeSOC investigation of CVE-2024-49138 exploitation alert involving PowerShell, EDRFreeze execution, and defense evasion behavior in a simulated…
cyb3rtus/keepass_cve-2023-24055_yara_ruleContains a simple yara rule to hunt for possible compromised KeePass config files
guardicode/cve-2021-44228_iocsCurated collection of public Indicators of Compromise (IoCs) for the Log4j vulnerability (CVE-2021-44228), aggregated from multiple sources for…
travisbgreen/cve-2025-8088cve-2025-8088_detection
fevar54/cve-2026-33634-scannerScanner de IOCs del ataque de cadena de suministro TeamPCP (CVE-2026-33634).
cyberdudebivash/cyberdudebivash-cisco-asyncos-cve-2025-20393-scannerThis tool helps identify exposure to CVE-2025-20393 by checking for open TCP/6025 ports, responsive Spam Quarantine interfaces, and known…
tarunbharathe/zero-click-rce-incident-response-cve-2025-21298Technical investigation and host containment of a Critical-severity Zero-Click RCE exploit (CVE-2025-21298) using EDR telemetry and static malware…
cybersecurity-enthusiasts-ce/cve-2025-55182-researching-processDefensive research repository for CVE-2025-55182 (Pre-Auth RCE in React Server Components/Next.js). Includes technical analysis, detection rules…
suyash-r-k/dfir-malware-investigationSpring4Shell (CVE-2022-22965) DFIR lab with exploit simulation, Python WAF, IOC-based detection, and PCAP analysis.
garethmsheldon/cve-2025-60787-detection-motioneye-rce-via-config-injectionDetection rules and YARA/KQL signatures for CVE-2025-60787, an unauthenticated RCE in motionEye via config injection, with process execution and file…
pisut4152/sigma-rule-for-cve-2021-40438-exploitation-attemptSigma-Rule-for-CVE-2021-40438-Attack-Attemp
faysalferdous/cve-2025-68645-exploiting-zimbra-webmail-lfi-vulnerabilityDefender-focused reference pack for CVE-2025-68645 Zimbra LFI, including Sigma/Splunk detection rules, WAF mitigation snippets, IOC patterns, and…
