Tools

murrayr0123/cve-2024-3400-compromise-checker

A simple bash script to check for evidence of compromise related to CVE-2024-3400

zach115th/toolshellfinder

Scans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771

bengisugun/cve-2022-22972-

IOC List

dcscoder/exchange_ioc_hunter

CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065

yami0x777/belsen_group-et-exploitation-de-la-cve-2022-40684

Analyzes a dark web leak of 15,000+ Fortinet devices compromised via CVE-2022-40684, providing IOCs, impacted versions, and a Python script to…

jmussmann/cve-2023-4966-iocs

Python script to search Citrix NetScaler logs for possible CVE-2023-4966 exploitation.

bakedmuffinman/blacklotusdetection

Created to help detect IOCs for CVE-2022-21894: The BlackLotus campaign

mikesxrs/cve-2023-21716_yara_results

Results of retrohunt for files matching YARA rules from https://github.com/AmgdGocha/Detection-Rules/blob/main/CVE-2023-21716.yar

soteria-security/hafnium-ioc

A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865

mandiant/ioc-scanner-cve-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781

mandiant/citrix-ioc-scanner-cve-2023-3519

Bash-based scanner detecting indicators of compromise from CVE-2023-3519 exploitation on Citrix ADC appliances, supporting live and forensic image…

deadbits/yara-rules

Collection of YARA signatures from individual research

cisagov/check-your-pulse

This utility can help determine if indicators of compromise (IOCs) exist in the log files of a Pulse Secure VPN Appliance for CVE-2019-11510.

cert-lv/exchange_webshell_detection

Detect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857,…

sucuri-labs/cve-2025-57819-ioc-check

This is repository contains a script to check for current IOCs listed in the freepbx forum topic of the CVE-2025-57819