Tools

guardicode/cve-2021-44228_iocs

Curated collection of public Indicators of Compromise (IoCs) for the Log4j vulnerability (CVE-2021-44228), aggregated from multiple sources for…

nict-csl/exist

Web application for aggregating and analyzing cyber threat intelligence from multiple feeds and APIs, enabling cross-search of indicators, automated…

synacktiv/hexalocker-analysis

YARA rule and IOC repository for HexaLocker ransomware analysis, providing hashes, domains, and detection logic based on Synacktiv's research.

hamza-megahed/odin

Centralized IoC scanner that deploys Loki across endpoints, collects detection results, and parses logs into CSV for incident response and forensic…

mitre-attack/attack-stix-data

STIX 2.1 collections of the MITRE ATT&CK knowledge base, providing adversary tactics and techniques for enterprise, mobile, and ICS threat…

sh0ckfr/log4j-cve-2021-44228-public-iocs

Curated list of public Indicators of Compromise (IoCs) for CVE-2021-44228 (Log4Shell), including IPs, callback domains, and file hashes, with sources…

bitsalv/toolshell-honeypot

Docker-based honeypot for detecting and logging SharePoint zero-day exploitation attempts, featuring tag-based IOC/pattern/heuristic detection, YARA…

mrezqi/cve-2021-1675_carbonblack_huntingquery

CarbonBlack hunting queries to detect PrintNightmare (CVE-2021-1675) exploitation via file, module load, and process events, based on Sigma rules.

emalderson/thephish

Automated phishing email analysis tool integrating TheHive, Cortex, and MISP to extract observables, run analyzers, calculate verdicts, and notify…

zedocun/soc-investigation-powershell-edrfreeze

SOC investigation of CVE-2024-49138 exploitation alert involving PowerShell, EDRFreeze execution, and defense evasion behavior in a simulated…

rurik/noriben

Python-based malware analysis sandbox that integrates with Sysinternals Procmon to automatically collect, analyze, and report runtime indicators with…