Wp2shell-ioc-scanner

wp2shell IOC Scanner Version 1.4.0 · GPL-2.0-or-later · WordPress 6.0+ · PHP 7.4+ A read-only-by-default triage tool for the WordPress core vulnerabilities CVE-2026-60137 and CVE-2026-63030 “wp2shell”. It checks patch state, accounts, durable database artifacts and file integrity, separates...

spyre

Spyre ...a simple, self-contained modular host-based IOC scanner Spyre is a simple host-based IOC scanner built around the YARA pattern matching engine and other scan modules. The main goal of this project is easy operationalization of YARA rules and other indicators of compromise. Users need to...

muad-dib

Installation | Usage | Features | VS Code | CI/CD Version francaise Why MUAD'DIB? npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond. MUAD'DIB combines 22 parallel scanners 278 detection rules, a...

Fenrir

Fenrir Simple Bash IOC Scanner Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for the following Indicators of Compromise IOCs: Hashes MD5, SHA1 and SHA256 using md5sum, sha1sum, sha -a 256 File Names string - checked for substring of the full path, e.g...

ioc-scanner-CVE-2019-19781

Indicator of Compromise Scanner for CVE-2019-19781 This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2019-19781. The utility, and its resources, encode indicators of compromise collected during FireEye Mandiant investigations. To learn more, plea...

odin

Odin Odin es un escáner central de IoC basado en Loki Tabla de contenidos Información General Requisitos Descarga Despliegue de Loki Recolección Análisis Información General Esta aplicación descarga la última versión de Loki y la descarga en todas las máquinas usando un script de PowerShell y lo...

CVE-2019-19871-AuditGuide

Update 1-22-2020 There is now a tool from FireEye that will help scan these items below. The key to this is that you need to have enough logs to go back to 1-9-2020 to have a chance to see what was done beyond the exploit was ran. If it finds .XML payload files then you need to use the informatio...

citrix-ioc-scanner-cve-2023-3519

CVE-2023-3519 用侵害指標スキャナー このリポジトリには、CVE-2023-3519 に関連する Citrix ADC アプライアンスの侵害を検出するためのユーティリティが含まれています。 このユーティリティとそのリソースは、Mandiant の調査中に収集された侵害指標をエンコードしています。 詳細については、このツールのリリースを発表したブログ記事 をご覧ください。 要約すると、このユーティリティは以下を行います。 既存の侵害を特定するためのベストエフォート型の処理を実行します。 以下のことは行いません 。 侵害を常に 100% 特定することはできません。...

ioc-scanner-CVE-2019-19781

CVE-2019-19781 の侵害指標スキャナ このリポジトリには、CVE-2019-19781に関連するCitrix ADCアプライアンスの侵害を検出するためのユーティリティが含まれています。 このユーティリティとそのリソースは、FireEye Mandiantの調査中に収集された侵害指標をエンコードしています。 詳細については、このツールのリリースを発表したブログをご覧ください。 要約すると、このユーティリティは次のことを行います： 既存の侵害を特定するために最善を尽くします。 次のことは しません ： 100%の確率で侵害を特定すること、または...

agentic-ioc-scanner

agentic-ioc-scanner IOC scanner for agentic AI coding tools — detects Mini Shai-Hulud, Gemini CLI RCE, Cursor CVE-2026-26268, and DPRK PromptMink. A detection kit for compromise of agentic AI coding assistants Claude Code, Gemini CLI, Cursor and the dependencies they pull into your repos. Eleven...

Odin - Central IoC Scanner Based On Loki

Odin is a central IoC scanner based on Loki General Info This application Loki latest version and download it on all machines using a powershell script and run it then this app receives the respose from all machines and parse the feed in CSV form. Requirements 1. Python +3.5 2. PyQT5 3. psutil 4...

Nice Try: 501 (Ransomware) Not Implemented

An Ever-Evolving Threat Since January 10, 2020, FireEye has tracked extensive global exploitation of CVE-2019-19781, which continues to impact Citrix ADC and Gateway instances that are unpatched or do not have mitigations applied. We previously reported on attackers’ swift attempts to exploit thi...

Simple IOC and Incident Response Scanner: Loki

LOKI is a free and simple IOC scanner, a complete rewrite of main analysis modules of our full featured APT Scanner THOR. IOC stands for „Indicators of Compromise“. These indicators can be derived from published incident reports, forensic analyses or malware sample collections in your Lab. LOKI...

Loki - Scanner for Simple Indicators of Compromise

Simple IOC Scanner Detection is based on four detection methods: 1. File Name IOC Regex match on full file path/name 2. Yara Rule Check Yara signature match on file data and process memory 3. Hash check Compares known malicious hashes MD5, SHA1, SHA256 with scanned files The Windows binary is...