Tools

eclecticiq/opentaxii

TAXII server implementation in Python from EclecticIQ

paloaltonetworks/unit42-threat-intelligence-article-information

This is the repository for indicators of compromise (IOCs) and other data for threat intelligence articles posted on the Palo Alto Networks Unit 42…

elastic/labs-releases

Elastic Security Labs releases

wiz-sec-public/wiz-research-iocs

Curated public database of indicators of compromise aggregated by Wiz Research for threat detection, hunting, and incident response workflows.

mubix/cve-2021-44228-log4shell-hashes

Hashes for vulnerable LOG4J versions

taxiiproject/libtaxii

A Python library for handling TAXII Messages invoking TAXII Services.

packetsifter/packetsiftertool

PacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…

concinnity-risks/ransomcoinpublic

A DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries.

carbonblack/active_c2_ioc_public

Active C2 IoCs

deepfield/public-research

DDoS botnet research and indicators of compromise from Nokia Deepfield ERT

citrix/ioc-scanner-cve-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781

reddrip7/log4shell_cve-2021-44228_related_attacks_iocs

Curated repository of Indicators of Compromise (IOCs), attack source IPs, and Snort/Suricata detection rules for Log4Shell (CVE-2021-44228) attacks.

pr0xylife/emotet

IOC Collection 2022

fireeye/cve-2021-44228

OpenIOC rules to facilitate hunting for indicators of compromise

threatray/threat-research

IoCs and YARA rules from Threatray's Threat Research

opensourcemalware/vercel-april2026-incident-response

This is an incident response playbook we created for the Vercel April 2026 compromise

pandare9x/malware

IOCs and notes related to malware