Archived
HAFNIUM-IOC
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
digital-forensicsforensicsincident-response+3
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
nccgroup/mortimerA collection of scripts for processing network forensics type data and intelligence, mainly into a postgres database.
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
00gxd14g/misp-extractorExtracts selected MISP attributes, including IP addresses, URLs, and hashes, into reusable output files.
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
garethmsheldon/cve-2025-60787-detection-motioneye-rce-via-config-injection
michaael01/letsdefend--soc-342-cve-2025-53770-sharepoint-exploit-toolshell
sophoslabs/iocsSophos-originated indicators-of-compromise from published reports
paloaltonetworks/unit42-timely-threat-intelA collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.
volexity/threat-intelSignatures and IoCs from public Volexity blog posts.
gendigitalinc/iocA continuously updated collection of threat intelligence indicators of compromise (IOCs), including YARA rules, for detecting and tracking malware…
akamai/akamai-security-researchThis repository includes code and IoCs that are the product of research done in Akamai's various security research teams.
karib0u/rustinelOpen-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.
apr4h/cobaltstrikescanScan files or process memory for CobaltStrike beacons and parse their configuration
prodaft/malware-iocThis repository contains indicators of compromise (IOCs) of our various investigations.
fhightower/ioc-finderPython library for extracting Indicators of Compromise, URLs, IP addresses, hashes, and email addresses from text using declarative grammars instead…