capa
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
ai-assisted-reversingbinary-analysiscode-analysis+10
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
insane-forensics/drovorub-huntA tool to assist with network-based hunting for GRU's Drovorub malware c2
virustotal/yara-xRust-based pattern matching engine for malware researchers. Create YARA rules with textual/binary patterns, wildcards, and regex to identify and…
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
pirxthepilot/wtfisPassive hostname, domain and IP lookup tool for non-robots
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
1an0rmus/tekdefense-automaterModular OSINT analysis tool automating lookups of IP addresses, URLs, and MD5 hashes across multiple sources, with configurable XML-based source…
misp/misp-taxonomiesTaxonomies used in MISP taxonomy system and can be used by other information sharing tool.
jangeisbauer/gundogPowerShell-based guided hunting tool for Microsoft 365 Defender that automates alert triage, entity enrichment, and IOC lookups across email and…
payloadsecurity/sandbox_scryerParses public sandbox detonation reports to produce threat hunting intelligence, organizes findings via MITRE ATT&CK, assembles IOCs, and generates…
misp/misp-galaxyClusters and elements to attach to MISP events or attributes (like threat actors)
cspf-founder/darwis-taxiiA high-performance TAXII (Trusted Automated eXchange of Indicator Information) server written in Rust.