indicators-of-compromise

There are 12 repositories under indicators-of-compromise topic.

ThePhish
emalderson / ThePhish
ThePhish: an automated phishing email analysis tool
attack cyberdefense cybersecurity detection digital-forensics email free incident-response indicators-of-compromise malware misp phishing phishing-detection python script thehive thehive4 thehive4py threat-intelligence webapp
Language:Python 1120
InQuest / ThreatIngestor
Extract and aggregate threat intelligence.
ioc indicators-of-compromise threatintel threat-intelligence osint dfir malware-research security-tools threat-sharing threat-feeds threat-hunting misp fraud-detection threat-analysis intelligence-gathering threat-intelligence-platform yara soar
Language:Python 821
reversinglabs-yara-rules
reversinglabs / reversinglabs-yara-rules
ReversingLabs YARA Rules
reverse-engineering yara-rules yara-signatures ransomware-detection ransomware-prevention malware-detection indicators-of-compromise yara
Language:YARA 744
drb-ra / C2IntelFeeds
Automatically created C2 Feeds
iocs indicators-of-compromise threat-intelligence threatintel threat-hunting poshc2 metasploit empire cobaltstrike cobalt-strike
Language:REXX 509
InQuest / iocextract
Defanged Indicator of Compromise (IOC) Extractor.
ioc indicators-of-compromise library ioc-extractor defang threat-intelligence threat-sharing threatintel malware-research osint dfir base64 decoding yara
Language:Python 497
PaloAltoNetworks / Unit42-timely-threat-intel
A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.
hub indicators-of-compromise threat-intelligence
170
assafmo / xioc
Extract indicators of compromise from text, including "escaped" ones.
ioc iocs extract extraction text-mining text-processing indicators-of-compromise command-line-tool command-line defang escaping regex regexp data-mining
Language:Go 161
fhightower / ioc-finder
Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/
indicators-of-compromise threat-intelligence threat-hunting threat-sharing grammar-parser threatintel cidr-range ipv4 iocs ioc-finder observable network-data cidr-ranges parse-urls grammars malware-research malware-analysis hacktoberfest
Language:Python 157
fox-it / cobaltstrike-beacon-data
Open Dataset of Cobalt Strike Beacon metadata (2018-2022)
python json pandas jupyter jupyter-notebook dataset cobaltstrike beacon threat-intelligence research iocs indicators-of-compromise
Language:Jupyter Notebook 122
401trg / detections
This repository contains all public indicators identified by 401trg during the course of our investigations. It also includes relevant yara rules and ids signatures to detect these indicators.
401trg protectwise ioc indicators indicators-of-compromise threat-hunting threat-analysis verizon
Language:Python 120
vuldb / cyber_threat_intelligence
Cyber Threat Intelligence Data, Indicators, and Analysis
cyber-threat-intelligence cyber-threats cti ioc indicator-of-compromise malware exploit ioa indicators-of-compromise threat-intelligence
71
ioc-fang / ioc-fanger
Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .
threatintel threat-sharing ioc defang fang iocs indicators indicators-of-compromise malware malware-research hacktoberfest
Language:Python 55
ninoseki / ioc-extractor
An npm package for extracting common IoC (Indicator of Compromise) from a block of text
threat-intelligence indicators-of-compromise
Language:TypeScript 53
swisscom / detections
Threat intelligence and threat detection indicators (IOC, IOA)
indicators-of-compromise indicators detection threat-detection
Language:YARA 51
rstcloud / rstthreats
Aggregated Indicators of Compromise collected and cross-verified from multiple open and community-supported sources, enriched and ranked using our intelligence platform for you. Threat Intelligence, Threat feed, Open source feed.
threat-intelligence threatintel indicators-of-compromise cybersecurity
Language:HTML 34
cyb3rmik3 / Hunting-Lists
A repository of curated lists with elements such as IoCs to use for threat hunting & detection queries.
indicators-of-compromise ioc iocs tld tlds keyword keyword-spotting keywords
31
hm-seclab / YAFRA
YAFRA is a semi-automated framework for analyzing and representing reports about IT Security incidents.
ioc incident-response cybersecurity threatintel threat-intelligence threat-hunting indicators indicators-of-compromise ioa cyber-threat-intelligence cyberthreatintelligence cyber-threats cyber-threat-analyst intelligence threat-intel malware-research misp git gitlab github
Language:Python 27
gnxsecurity / gnx-threat-intelligence
A commercial grade threat intelligence feed thats validated and updated every half hour.
threat-intelligence threat-sharing indicators-of-compromise blacklist blocklist malicious-traffic
Language:SuperCollider 19
MishcondeReya / Covid-19-CTI
A collection of Covid-19 related threat intelligence and resources.
coronavirus-phishing threat-intelligence cyber-security coronavirus-scams covid-19 cyber-threat-intelligence indicators-of-compromise cybersecurity-reports threatintel infosec
19
levlesec / cellebrite-ioc
An IOC collection for the Cellebrite UFED forensic toolkit.
antiforensics malware indicators-of-compromise
18
alphaSeclab / malware-ioc-hash
Collection of malware ioc hashes from blog posts. A Python script is provided to search through it.
malware indicators-of-compromise malware-ioc
Language:Python 16
Lyc4on / EvtXHunt
EvtXHunt is an Autopsy plugin that is able to analyze Windows EVTX logs against a library of SIGMA rules.
evtx indicators-of-compromise autopsy digital-forensics sigma cybersecurity
Language:Python 15
databricks-industry-solutions / ioc-matching
IOC matching for incident responders, threat hunters, detection engineers, and security engineers.
cybersecurity databricks-industry-solutions dlt indicators-of-compromise threat-hunting detection-e forensics incident-response
Language:Python 14
edoardottt / defango
URL / IP / Email defanging with Golang. Make IoC harmless.
defang defanging defense defensive-security go golang golang-module golang-package indicators-of-compromise ioc malware malware-analysis malware-protection malware-research security phishing phishing-protection email-security web-security websecurity
Language:Go 12
silascutler / IntelDB
Minimal Indicator Storage System
malware malware-analysis indicators-of-compromise
Language:Python 11
HappyStoic / iris
Iris - P2P System for Confidential Sharing of Threat Intelligence and Collaborative Defense for Slips
idn ips libp2p p2p p2p-network slips threat-intelligence collaborative-defense distributed go golang indicators-of-compromise ipfs peer-to-peer
Language:Go 9
martinkubecka / C2Detective
:mag: Application for detecting command and control (C2) communication through network traffic analysis.
blueteam command-and-control network-analysis security c2 dga-detection ja3 statistical-analysis enrichment indicators-of-compromise iocs
Language:Python 9
ninoseki / fanger
An npm package to defang and refang IoC
indicators-of-compromise
Language:TypeScript 9
atakanaydinbas / gofangdefang
GoFangDefang is a Go library for secure manipulation of Indicators of Compromise (IOCs), converting them between their original "fang" format (with special characters) and a safer "defang" format. It prevents accidental execution of potentially malicious IOCs like URLs, IPs, domains, or subdomains.
ioc malicious security-tools defang fang indicators-of-compromise malware malware-research
Language:Go 8
Geekmaster-General / IOCs
Storage for the IOCs I collect
indicators-of-compromise advanced-persistent-threat-data ransomware-resources threat-hunting threat-intelligence malware-resources phishing-sites
7
hrbrmstr / extractor
⛏macOS app to extract IoCs from PDFs, text files, HTML, URLs, and the pasteboard
ioc indicators-of-compromise macos-app macos swift
Language:Swift 7
Lupovis / Prowl-API
Prowl is an API that allows you to send IP and in return obtain the reputation of the IP as well as indicators of attacks and indicators of compromise associated with the address. Lupovis monitors the web in real time and identifies malicious IP addresses for you.
cybersecurity geolocation indicators-of-compromise infosec ip-lookup ip-lookup-api ip-reputation ip-reputation-checker nodejs osint reconnaissance security security-tools indicators-of-attack anti-bot anti-spam antispam ip-blacklist ip-blocklist ipscore
Language:JavaScript 7
elliotwutingfeng / rstthreatsall
This repository consolidates all unique IOCs ever released at rstthreats. Updated at least once a day.
indicators-of-compromise ioc malicious osint cybersecurity malware threat-intel threat-intelligence hacktoberfest
Language:Python 6
RussianPanda95 / Malware
IOCs and notes related to malware
indicators-of-compromise malware-analysis malware-research
Language:Python 6
securechicken / tinypeg
Provides Amnesty International's "Pegasus" domain IOCs transformation to a TinyCheck source format
indicators-of-compromise ioc pegasus nso tinycheck
Language:Shell 6
kamakala / ip-reputation-scanner
Relieving the manual task of checking the ip reputation
indicators-of-attack indicators-of-compromise ip ip-blacklist-checker ip-lookup-api ip-reputation ip-reputation-checker malicious-ip-detection malicious-traffic osint reputation reputation-api security security-tools
Language:Python 5