Tools

karib0u/rustinel

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

paloaltonetworks/unit42-timely-threat-intel

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.

mvt-project/mvt

Forensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…

threatray/threat-research

IoCs and YARA rules from Threatray's Threat Research

ctrlaltint3l/intelligence

Centralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…

lukehebe/kql-hunting_and_detection-queries

Some of my KQL hunting queries

certsocietegenerale/fir

Fast Incident Response

iocx-dev/iocx

An extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern…

honeylabshq/spip-go

Spip network sensor written in Go

cisco-talos/iocs

Indicators of Compromise

circl/ail-framework

AIL framework - Analysis Information Leak framework. Project moved to https://github.com/ail-project

opencve/opencve

Aggregate, filter, and track CVEs from multiple sources with team collaboration, custom dashboards, alerts, and AI-powered analysis for vulnerability…

threatlabz/iocs

This repository is for Indicators of Compromise (IOCs) from Zscaler ThreatLabz public reports

spectralzero/netscope

Offline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…

wiz-sec-public/wiz-research-iocs

Curated public database of indicators of compromise aggregated by Wiz Research for threat detection, hunting, and incident response workflows.

creamyg31337/ncentral-compromise-ioc-triage

Read-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints

ares-sys/uefi_bootkit_softlanding

First public analysis of SoftLanding UEFI bootkit: Ring -2 implant, CVE-2025-7029, 240+ Gigabyte boards, GPU AI evasion, dual C2. YARA + Sigma +…

k1nd0ne/volweb

A centralized and enhanced memory analysis platform