Tools

amnestytech/investigations

Indicators of Compromise from Amnesty International's cyber investigations

paloaltonetworks/unit42-timely-threat-intel

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.

duggytuxy/data-shield_ipv4_blocklist

Curated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…

mitre-attack/attack-stix-data

STIX 2.1 collections of the MITRE ATT&CK knowledge base, providing adversary tactics and techniques for enterprise, mobile, and ICS threat…

cisco-talos/iocs

Indicators of Compromise

gendigitalinc/ioc

Threat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs.

akamai/akamai-security-research

This repository includes code and IoCs that are the product of research done in Akamai's various security research teams.

pedramamini/iocextract

Defanged Indicator of Compromise (IOC) Extractor.

fhightower/ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related…

prodaft/malware-ioc

This repository contains indicators of compromise (IOCs) of our various investigations.

rushter/hexora

Static analysis of malicious Python code

paloaltonetworks/unit42-threat-intelligence-article-information

This is the repository for indicators of compromise (IOCs) and other data for threat intelligence articles posted on the Palo Alto Networks Unit 42…

abhinavbom/threat-intelligence-hunter

TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea…

wiz-sec-public/wiz-research-iocs

Curated public database of indicators of compromise aggregated by Wiz Research for threat detection, hunting, and incident response workflows.

cobalt-strike/sleep_python_bridge

This project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need…

cred-club/artif

An advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.

assafmo/xioc

Extract indicators of compromise from text, including "escaped" ones.