WhacAMole
ignacioj/whacamoleLive memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment…
binary-analysisdebuggersdigital-forensics+9
ignacioj/whacamoleLive memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment…
sifalcon/detectionCurated collection of detection rules and IOCs extracted from DFIR engagements and malware analyses to support threat hunting, incident response, and…
kadir/copy-fail-cve-2026-31431-iocDetection, mitigation, and IOC toolkit for Copy Fail CVE-2026-31431 Linux kernel page-cache privilege escalation
opensourcemalware/vercel-april2026-incident-responseThis is an incident response playbook we created for the Vercel April 2026 compromise
rorywag/hayabusa-bulk-runnerBulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard
corelight/hasshFingerprint SSH clients and servers.
helgesverre/livewire-honeypotHigh-interaction honeypot mimicking a vulnerable Laravel/Livewire app. Captures RCE exploits and webshells targeting CVE-2024-47823, CVE-2025-54068,…
ahmed-tarek22752/security-vulnerability-in-microsoft-office.Blue-team analysis of a malicious DOCX exploiting CVE-2017-0199, covering sandbox detonation, network forensics, IOC extraction, MITRE ATT&CK…
habibkaratas/sorry-ransomware-analysisSorry ransomware (.sorry) IOCs, YARA rules and forensic analysis - CVE-2026-41940 cPanel campaign
hackinglz/panrapidcheckExtract useful information from PANOS support file for CVE-2024-3400
bryanster/ioc-cve-2022-42475test for the ioc described for FG-IR-22-398
jchable/miasma-toolkitDetection & remediation toolkit for the Miasma / Shai-Hulud worm and CVE-2026-35603 (AI-agent/IDE config injection)
vishvacyber/detection-tool-kit-for-cve-2026-31431Layered detection toolkit for CVE-2026-31431 (Copy Fail) Linux kernel LPE. Provides eBPF, auditd, Sigma rules, page-cache diff, and IOC guides for…
limo57640-crypto/wp-user-registration-vuln-checkerRead-only WordPress User Registration CVE-2026-1492 checker for hidden admins, plugin version, uploads PHP, cron, and compromise IOCs.
limo57640-crypto/cpanel-cve-41940-detectorRead-only cPanel CVE-2026-41940 IOC detector for .sorry ransomware, Mr_Rot13 Filemanager backdoors, C2 callbacks, cron, SSH, and logs.
shayr1/shai-hulud-scanClaude Code skill to scan machines for Mini Shai-Hulud (CVE-2026-45321) supply chain worm IOCs
suyash-r-k/dfir-malware-investigationSpring4Shell (CVE-2022-22965) DFIR lab with exploit simulation, Python WAF, IOC-based detection, and PCAP analysis.