Tools

bushidouk/abused-legitimate-services

Cloud, CDN, and marketing services leveraged by cybercriminals and APT groups

scoubi/bloodsocer

Aggregates MITRE ATT&CK, Sigma, and Atomic Red Team data into BloodHound graphs so SOC analysts can map detection coverage, identify gaps, and…

olizimmermann/phishcollector

PhishCollector is a research framework for collecting, analysing, and tracking phishing sites.

synacktiv/synacktiv-rules

Public repository of Sigma and YARA rules created by Synacktiv

kaal22/darkgrid

3D threat intelligence dashboard that visualizes malicious infrastructure from OSINT sources like AbuseIPDB and OpenPhish, with a live threat feed,…

fastfire/ioc_attack_esxi_feb_2023

Collection of IoCs available and related to attacks on ESXi infrastructures that occurred as of Friday February 3, 2023.

aquasecurity/vexhub-crawler

Collect VEX documents and update VEX Hub

sumidcyber/zeroscout

🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…

soldier0x0/briefr

Open Vulnerability Intelligence platform, aggregated intel in one dashboard, with correlation and IOC lookups, completely self hosted. All resources…

xghst0/reconkg

Vulnerability triage with provenance. Resolves CVEs from locally built corpora (NVD/KEV/EPSS, ExploitDB, nmap script.db) and emits verification…

gnomeman/badbanana-threat-observatory

Threat intel observatory aggregating CISA KEV, ThreatFox, URLhaus, and MalwareBazaar feeds with search, change tracking, and STIX/CSV/JSONL export.

functori/argos/argos

Analysis and Representation of Graphs of Suspicious Operations (Analyse et Représentation des Graphes des Opérations Suspectes)

jithinkrishnanrs/gitlab-cve-2026-85706-ioc

CVE-2026-85706 — GitLab Path Traversal IOC Scanner & Detection Toolkit. Detect and hunt for exploitation of the critical unauthenticated GitLab CE/EE…

adham504/sentinelthread-forensics

High-speed Windows forensic triage platform that orchestrates the Hayabusa engine to transform raw EVTX logs into prioritized threat timelines with…

renat0z3r0/notepadpp-supply-chain-iocs

IoCs and detection rules for the Notepad++ supply chain attack (CVE-2025-15556) — Lotus Blossom APT, June–December 2025. Includes Falcon LogScale…

knqyf263/vuln-list-backup

Collects vulnerability and advisory data from multiple public security feeds and stores it in a parsable, structured format for downstream security…

ethan-andrews/threatintel-aggregator

Self-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineering. Runs…

duggytuxy/data-shield_ipv4_blocklist

Curated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…