Tools

bruneaug/dshield-siem

DShield Sensor Log Collection with ELK

mfmokbel/crawlector

Crawlector is a threat hunting framework designed for scanning websites for malicious objects.

hackinghippo/log4shell_ioc_ips

log4j / log4shell IoCs from multiple sources put together in one big file (IPs) more coming soon (CVE-2021-44228)

m4nbat/100_days_of_kql_2026

A repo to hold KQL queries as part of my 100 days of KQL effort.

blevene/bandjacks

Cyber Threat Defense World Modeling

insane-forensics/drovorub-hunt

A tool to assist with network-based hunting for GRU's Drovorub malware c2

teycir/seekyou

OSINT intelligence on any IP, domain, or ASN

malvuln/sigint-hombre

Dynamically generated Suricata rules from real-time threat feeds

rxerium/honeypot

🍯Honeypot Threat Intel

cross-samuel1/soc-analyst-hub

Free, offline SOC Analyst Hub for Tier 1 — IR checklists, alert triage playbooks, threat hunting queries & analyst onboarding. Single HTML file, no…

facebook/threatexchange

Trust & Safety tools for working together to fight digital harms.

phishdestroy/destroylist

Real-time phishing & scam domain blocklist - 208k+ curated threats, 1M+ community, free API, multiple formats

virustotal/yara-x

A rewrite of YARA in Rust.

paloaltonetworks/unit42-timely-threat-intel

A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.

bfuzzy/auditd-attack

A Linux Auditd rule set mapped to MITRE's Attack Framework

cisco-talos/iocs

Indicators of Compromise

curated-intel/ukraine-cyber-operations

Curated Intelligence is working with analysts from around the world to provide useful information to organisations in Ukraine looking for additional…