Tools

karib0u/rustinel

Open-source endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account…

mvt-project/mvt

Forensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…

mthcht/awesome-lists

Curated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.

magicsword-io/loldrivers

Curated database of vulnerable and malicious Windows drivers with YARA, Sigma, ClamAV, and Sysmon detection rules for proactive threat hunting and…

opencti-platform/opencti

Open Cyber Threat Intelligence Platform

misp/misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)

r3nzsec/irflow-timeline

DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…

cisco-talos/iocs

Indicators of Compromise

neo23x0/signature-base

YARA signature and IOC database for my scanners and tools

threatray/threat-research

IoCs and YARA rules from Threatray's Threat Research

julioliraup/antiphishing

Advanced Phishing Protection: Suricata rulesets open and free

infostealers-stats/data-breach

A continuously updated resource that catalogs confirmed data breaches from across the globe. Each entry includes the breach name, usually aligned…

yeti-platform/yeti

Your Everyday Threat Intelligence

shuffle/shuffle

Open-source security orchestration, automation, and response (SOAR) platform with a visual workflow editor, prebuilt security app integrations, and…

toborrm9/malicious_extension_sentry

Malicious Extension Database

sigmahq/sigma

Main Sigma Rule Repository

stamparm/maltrail

Real-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…