#1Tools for managing, sharing, and integrating Indicators of Compromise (IOCs) into security defenses.
Kitploit recommended
vignesh-hp/lockbit-ransomware-analysisThreat intelligence and incident response case study on LockBit ransomware exploiting CVE-2023-4966 (Citrix Bleed).
bitsalv/toolshell-honeypotHoneypot for CVE-2025-53770 aka ToolShell
macuchegit/detecting-and-analyzing-cve-2024-24919-exploitationStep-by-step walkthrough of detecting and analyzing CVE-2024-24919 exploitation using a SIEM platform, including traffic analysis, IOC documentation,…
mkdemir/activemq-lockbit-analysisApache ActiveMQ (CVE-2023-46604) zafiyetinden LockBit ransomware aşamasına uzanan 419 saatlik sızma vakasının uçtan uca analizi, SIEM korelasyon…
cyberbibs/soc274---palo-alto-networks-pan-os-command-injection-vulnerability-exploitation-cve-2024-3400-Step-by-step SOC analyst walkthrough for investigating and remediating CVE-2024-3400 (PAN-OS command injection). Covers detection, log analysis,…
cyberbibs/event-id-263-arbitrary-file-read-on-checkpoint-security-gateway-cve-2024-24919-Step-by-step SOC incident response walkthrough for CVE-2024-24919 arbitrary file read on Check Point gateways, covering detection, analysis,…
murrayr0123/cve-2024-3400-compromise-checkerA simple bash script to check for evidence of compromise related to CVE-2024-3400
paspke/scavenger_scannerDetect CVE-2025-54313 eslint-config-prettier supply chain attack IOCs on Windows
azeemering/cve-2019-19781-dfir-notesMy Citrix ADC NetScaler CVE-2019-19781 Vulnerability DFIR notes.
zach115th/toolshellfinderScans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771
mrezqi/cve-2021-1675_carbonblack_huntingqueryCarbonBlack hunting queries to detect PrintNightmare (CVE-2021-1675) exploitation via file, module load, and process events, based on Sigma rules.
anonaninda/aninda-security-advisoriesSecurity advisories published by Aninda , including CVE-2025-56608 and future findings.
l4r1k/citrixnetscaleranalysis🔬 Jupyter notebook to help automate some of the forensic analysis related to Citrix Netscalers compromised via CVE-2019-19781
digitalshadows/cve-2019-19781_iocsCurated indicators of compromise (IOCs) for CVE-2019-19781, including IP addresses and whois data from honeypot logs to aid threat detection and…
bridg3ops/soc335-cve-2024-49138-exploitation-detectedDetailed incident response walkthrough analyzing CVE-2024-49138 exploitation on Windows, covering process tree analysis, IOC identification, and…
fastmo/cve-2022-28672CVE-2022-28672 Vulnerabilidad Foxit PDF Reader - UaF - RCE - JIT Spraying
watchguard-threat-lab/log4shell-iocsA collection of IOCs for CVE-2021-44228 also known as Log4Shell
