Loki
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
anomaly-detectiondigital-forensicsdisk-forensics+11
3.8k
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
magicsword-io/loldriversCurated database of vulnerable and malicious Windows drivers with YARA, Sigma, ClamAV, and Sysmon detection rules for proactive threat hunting and…
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
bert-janp/open-source-threat-intel-feedsThis repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such…
misp/misp-galaxyClusters and elements to attach to MISP events or attributes (like threat actors)
certtools/intelmqIntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
mgeeky/protectmytoolingMulti-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking,…
rurik/noribenPython-based malware analysis sandbox that integrates with Sysinternals Procmon to automatically collect, analyze, and report runtime indicators with…
k1nd0ne/volwebA centralized and enhanced memory analysis platform
mitre-attack/attack-stix-dataSTIX 2.1 collections of the MITRE ATT&CK knowledge base, providing adversary tactics and techniques for enterprise, mobile, and ICS threat…
aquasecurity/vuln-list-updateAutomated vulnerability data aggregator that collects advisories from NVD, OSV, Alpine, Red Hat, and 20+ other sources into a unified parsable format…
karib0u/rustinelEndpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
misp/misp-taxonomiesTaxonomies used in MISP taxonomy system and can be used by other information sharing tool.
akamai/akamai-security-researchThis repository includes code and IoCs that are the product of research done in Akamai's various security research teams.
dev-lu/osint_toolkitOpen source platform for cyber security analysts with many features for threat intelligence and detection engineering.
gendigitalinc/iocThreat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs.
volexity/threat-intelSignatures and IoCs from public Volexity blog posts.