kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
xghst0/reconkgVulnerability triage with provenance. Resolves CVEs from locally built corpora (NVD/KEV/EPSS, ExploitDB, nmap script.db) and emits verification…
kaandemir993/redline-stealer-c2-defender-bypass-payload-analysis"Reverse engineering analysis of RedLine Stealer, a .NET-based info-stealer that uses C2 domains (198.46.86.63, tempuri.org), Windows Defender…
t-beckett/vulnbookStatic vulnerability findings tracker with parallel search across 11 CVE databases, EPSS enrichment, CISA KEV badges, coordinated disclosure…
volexity/threat-intelSignatures and IoCs from public Volexity blog posts.
sophoslabs/iocsSophos-originated indicators-of-compromise from published reports
hackinglz/extracteddefenderCollection of extracted Microsoft Defender data for security research purposes
vxunderground/threatintelligencediscordbotGets updates from various clearnet domains and ransomware threat actor domains
binref/refineryComposable command-line toolkit for malware triage and binary analysis: decode, decrypt, carve, and extract indicators from malicious files and…
the-dfir-report/sigma-rulesRules generated from our investigations.
blueteam0ps/memoptixA Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.
fhightower/ioc-finderPython library for extracting Indicators of Compromise, URLs, IP addresses, hashes, and email addresses from text using declarative grammars instead…
threatlabz/iocsCurated Indicators of Compromise and YARA rules from Zscaler ThreatLabz public reports for threat hunting, malware research, and detection…
jpcertcc/phishurl-listCurated dataset of confirmed phishing URLs from JPCERT/CC, including confirmation date, full URL, and spoofed brand for threat intelligence and…
criticalpathsecurity/zeek-intelligence-feedsAggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…
