Tools

zephrfish/cve-2025-53770-scanner

ToolShell scanner - CVE-2025-53770 and detection information

synacktiv/synacktiv-rules

Public repository of Sigma and YARA rules created by Synacktiv

hamza-megahed/odin

Centralized IoC scanner that deploys Loki across endpoints, collects detection results, and parses logs into CSV for incident response and forensic…

nccgroup/mortimer

A collection of scripts for processing network forensics type data and intelligence, mainly into a postgres database.

synacktiv/krustyloader-analysis

KrustyLoader Analysis

corelight/hassh

Fingerprint SSH clients and servers.

soufianetahiri/esxi_ransomware_bitcoinwallets

ESXi semi-automated ransomware attacks bitcoin wallets

navytitanium/eitest-tools-scripts-iocs

IOC feed and analysis toolkit for EITest campaigns, featuring C2 data decryption, victim payload decoding, and sinkhole log processing for threat…

lukehebe/kql-hunting_and_detection-queries

Some of my KQL hunting queries

corelight/extendintel

This package extends the Intel package to log more fields

rjsudlow/proxynotshell-ioc-checker

Script to check for IOC's created by ProxyNotShell (CVE-2022-41040 & CVE-2022-41082)

dahnutz/zimbra-cve-2026-73570-ir

Detection-first incident-response toolkit for Zimbra administrators investigating CVE-2026-73570. Searches logs for exploit indicators, examines…

creamyg31337/ncentral-compromise-ioc-triage

Read-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints

ace-responder/cve-2022-47966_checker

Run on your ManageEngine server

hackinglz/panrapidcheck

Extract useful information from PANOS support file for CVE-2024-3400

intrudify/mini-shai-hulud-scanner

Scanner for the Mini Shai-Hulud npm/PyPI supply chain worm (NHS CC-4781 · CVE-2026-45321). Detects gh-token-monitor persistence, payload artefacts,…

embee-research/agenttesla-config-extractor

Config extractor for AgentTesla - Discord/Telegram Variant