Tools

habibkaratas/sorry-ransomware-analysis

Sorry ransomware (.sorry) IOCs, YARA rules and forensic analysis - CVE-2026-41940 cPanel campaign

kadir/copy-fail-cve-2026-31431-ioc

Detection, mitigation, and IOC toolkit for Copy Fail CVE-2026-31431 Linux kernel page-cache privilege escalation

byinarie/zirconium

Tool to search for IOCs related to HAFNIUM: CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065

fevar54/cve-2026-33634-scanner

Scanner de IOCs del ataque de cadena de suministro TeamPCP (CVE-2026-33634).

mvt-project/mvt

Forensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…

shuffle/shuffle

Open-source security orchestration, automation, and response (SOAR) platform with a visual workflow editor, prebuilt security app integrations, and…

spectralzero/netscope

Offline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…

wiz-sec-public/wiz-research-iocs

Curated public database of indicators of compromise aggregated by Wiz Research for threat detection, hunting, and incident response workflows.

executemalware/malware-iocs

Curated collection of indicators of compromise extracted from real-world malware investigations, including hashes, domains, and IPs for threat…

emcghee/payloadautomation

Automates Cobalt Strike payload development, testing, and deployment via a Python-to-Sleep bridge; includes artifact inspection, IoC tracking, and…

0xtoxin/malware-iocs

Just my findings of malwares

cronup/malware-iocs

Collects and organizes malware indicators of compromise (IOCs) for rapid threat detection, incident response, and actionable intelligence sharing.

threatlabz/iocs

This repository is for Indicators of Compromise (IOCs) from Zscaler ThreatLabz public reports

sifalcon/detection

Curated collection of detection rules and IOCs extracted from DFIR engagements and malware analyses to support threat hunting, incident response, and…

fastfire/ioc_attack_esxi_feb_2023

Collection of IoCs available and related to attacks on ESXi infrastructures that occurred as of Friday February 3, 2023.

pr0xylife/emotet

IOC Collection 2022

binarly-io/supplychainattacks

Curated repository of documented firmware supply chain attacks, featuring IoCs, detection tools, and references to help defenders understand and…

creamyg31337/ncentral-compromise-ioc-triage

Read-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints