NexusFuzzy

CobaltSpam

Tool based on CobaltStrikeParser from SentinelOne which can be used to spam a CobaltStrike server with fake beacons

azorult

Leaked AzoRult Panel

Edison

Tool to decrypt encrypted strings in AgentTesla

redline_config

Tool to retrieve Config from Redline C2 servers

raccoon_config

Scans a list of raccoon servers from Tria.ge and extracts the config

AzoDecrypt

Script which is able to decrypt data sent to AzoRult 3.3 Server

NanoDump

Tool to decrypt the configuration of NanoCore and dump all used plugins

lokibot

Leaked LokiBot panel

vidar_config

Extracts Vidar config from Command & Control servers for specific botnets

OpenDirScanner

Python tool to scan a single IP or CIDR range of IP addresses for open directories

AzoBrute

A tool to bruteforce the encryption key and GUID for AzoRult 3.3

ds_store_grabber

DS_Store Mapper is a Python-based reconnaissance tool designed to recursively scan web servers for exposed .DS_Store files.

RDBye

Taxii2Misp

Ingest data from H-ISAC TAXII server into MISP

vidar_decrypt_strings

Ghidra Python script do decrypt strings in Vidar samples

angler

A python script which extracts URLs from executables via API hooking

CAPEv2

Malware Configuration And Payload Extraction

connectors

OpenCTI Connectors

evtx2json

A tool to convert Windows evtx files (Windows Event Log Files) into JSON format and log to Splunk (optional) using HTTP Event Collector.

PyVot

Python tool which leverages masscan and aslookup to pivot on existing investigation leads (IP addresses) to find other interesting findings.

VirustotalDownloader

Cortex Responder to download a file from VirusTotal (Private API key required) and add the file back to the case

Cortex-Analyzers

List of analyzers for Cortex

Cortex-Analyzers-1

Cortex Analyzers Repository

cratos-fastapi

The CRATOS proxy API integrates with your MISP instance and allows to extract indicators that can be consumed by security components such as SIEM, DNS, Proxies, Firewalls, EDR, NDR and other that can consume a file with indicators.

gitdir

Download a single directory/folder from a GitHub repo

lamson

Pythonic SMTP Application Server

shiva

Spam Honeypot with Intelligent Virtual Analyzer

Sirene

SMTP Honeypot written in Python which acts as a a fake open relay

terracontrol

Terrariumsteuerung auf Basis von Raspberry Pi

yara-java

Java bindings for Yara