maltrail
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
anomaly-detectionanti-botdefensive-tools+11
8.6k
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
misp/mispMISP (core software) - Open Source Threat Intelligence and Sharing Platform
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
mvt-project/mvtForensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…
deepfield/public-researchDDoS botnet research and indicators of compromise from Nokia Deepfield ERT
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
forrest-orr/monetaMoneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
fox-it/citrix-netscaler-triageForensic triage toolkit for Citrix NetScaler devices, featuring a Dissect-based IOC scanner for webshells, timestomping, and suspicious binaries,…
backbay-labs/thrunt-godThreat hunting command system for agentic IDEs
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
phishdestroy/destroylistReal-time phishing & scam domain blocklist - 208k+ curated threats, 1M+ community, free API, multiple formats
nomi-sec/nvd-database📕NVD Database
svdwi/blueboxOpen-source threat intelligence platform for malware and observable analysis. Enriches IPs, domains, URLs, and hashes with external sources, performs…
citrix/ioc-scanner-cve-2019-19781Indicator of Compromise Scanner for CVE-2019-19781
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
tica506/siem-queries-for-cve-2021-44228SIEM query collection for detecting Log4Shell (CVE-2021-44228) exploitation attempts. Provides ready-to-use detection rules for security monitoring…