gnomeman/badbanana-threat-observatoryThreat intel observatory aggregating CISA KEV, ThreatFox, URLhaus, and MalwareBazaar feeds with search, change tracking, and STIX/CSV/JSONL export.
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
limo57640-crypto/wp-user-registration-vuln-checkerRead-only WordPress User Registration CVE-2026-1492 checker for hidden admins, plugin version, uploads PHP, cron, and compromise IOCs.
defensepointsecurity/threat_noteLightweight investigation notebook for tracking threat intelligence, indicators of compromise (IOCs), and managing security incident response…
jonathanstross/cve-2025-31324Python scanner for detecting CVE-2025-31324 in SAP Visual Composer, with custom IOC-based webshell detection and multi-target CSV input.
pascalasch/cve-2023-38831-kqlKQL hunting query for Microsoft Defender for Endpoint to detect WinRAR file extension spoofing (CVE-2023-38831) using IOCs and file event analysis.
emergingthreats/threatresearchProofpoint - Emerging Threats - Threat Research tools + publicly shared intel and documentation
silascutler/malpipeMalware/IOC ingestion and processing engine
chaitanyakrishna/iocscraperIOCPARSER.COM is a Fast and Reliable service that enables you to extract IOCs and intelligence from different data sources.
osmankandemir/associated-threat-analyzerDetects malicious IPv4 addresses and domain names associated with a web application by comparing against local threat intelligence lists of known…
00gxd14g/misp-extractorExtracts selected MISP attributes, including IP addresses, URLs, and hashes, into reusable output files.
360netlab/dgaCurated repository of suspicious Domain Generation Algorithm (DGA) domains sourced from passive DNS and sandbox telemetry, with community-validated…
backbay-labs/thrunt-godThreat hunting command system for agentic IDEs
shadow0ps/cve-2023-20198-scannerThis is a webshell fingerprinting scanner designed to identify implants on Cisco IOS XE WebUI's affected by CVE-2023-20198 and CVE-2023-20273
vulncheck-oss/fetch-broker-confA go-exploit for fetching the RocketMQ broker configuration in order to discover indicators of compromise for CVE-2023-33246
montysecurity/c2-trackerLive Feed of C2 servers, tools, and botnets
assafmo/xiocExtract indicators of compromise from text, including "escaped" ones.
hackinghippo/log4shell_ioc_ipslog4j / log4shell IoCs from multiple sources put together in one big file (IPs) more coming soon (CVE-2021-44228)
