Tools

rootless-ghost/vulnforge

Vulnerability & exploit intelligence — ExploitDB, NVD, Metasploit search with CVE→ATT&CK mapping and LogNorm/HuntForge integration | Part of Nebula…

misp/misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)

1an0rmus/tekdefense-automater

Automater - IP URL and MD5 OSINT Analysis

virustotal/yara-x

A rewrite of YARA in Rust.

pedramamini/threatingestor

Automated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…

mandiant/capa

Rule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…

insane-forensics/drovorub-hunt

A tool to assist with network-based hunting for GRU's Drovorub malware c2

payloadsecurity/sandbox_scryer

Parses public sandbox detonation reports to produce threat hunting intelligence, organizes findings via MITRE ATT&CK, assembles IOCs, and generates…

danieleperera/onioningestor

An extendable tool to Collect, Crawl and Monitor onion sites on tor network and index collected information on Elasticsearch