226 matches found
threat-research
此仓库包含与Threatray威胁研究相关的IoC和YARA规则，相关研究可在此处找到： https://www.threatray.com/blog 如需获取更新、研究亮点和分析见解，请在X（Twitter）上关注我们： https://x.com/ThreatrayLabs 仓库按文章组织，每篇文章包含特定研究的IoC、规则以及任何相关脚本。 提供的所有规则均受LICENSE.md中的检测规则许可（DRL）约束。...
CVE-2018-13379
IOC's for CObalt Strike/CVE-2018-13379 所有荣誉归功于 Awake/Arista/https://www.linkedin.com/in/kevin-romano-48071a42/ IOC复制自 DD: https://awakesecurity.com/blog/exploiting-cve-2018-13379-a-case-study-of-threat-actors-exploiting-years-old-cves/...
Malware-IOCs
Malware Repositorio de Indicadores de Compromiso...
Log4Shell_CVE-2021-44228_related_attacks_IOCs
Log4Shell（CVE-2021-44228）related attacks IOCs 源IP使用Apache Log4j RCE尝试攻击，其中包含很大部分Tor节点，详见Attack-IP.md 利用log4j漏洞传播的恶意程序、Botnet等IOC详见IOC-C2.md Snort检测规则详见Snort.md Suricata规则详见Suricata.md...
pe-bear
PE-bear PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files...
moneta
/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...
gundog
gundog gundog - PowerShell based guided hunting in Microsoft 365 Defender Gundog provides you with guided hunting in Microsoft 365 Defender. Especially if not only for Email and Endpoint Alerts at the moment. Functionality You provide an AlertID you might received via Email notification and gundo...
Kalim_Backdoor
Kalim后门恶意软件分析报告 本报告将讨论Kalim后门恶意软件的功能。 目录： - 什么是后门？ - 技术分析。 - 总结。 - 战术与技术（MITRE ATT&CK）。 - 入侵指标（IOCs）。 - Yara规则。 什么是后门？ 后门是一种隐藏的系统访问方法，可绕过正常身份验证和安全控制。 技术分析： 基础静态分析： 首先将其上传到VirusTotal进行初步分析。结果显示该文件是一个64位DLL，被识别为Kalim恶意软件家族。此外，多个检测结果提示其可能与MuddyWater威胁组织有关联。 该恶意软件还与域名moodleuni.com建立网络通信。...
honeypot.rs
honeypot.rs 该蜜罐针对 CVE-2023-46604 Apache ActiveMQ 远程代码执行漏洞 并专注于获取攻击指标。此蜜罐可用于任何威胁情报基础设施，以获取攻击者的IP地址、后渗透样本和恶意软件样本。这些信息有助于未来检测和预防攻击。 工作原理？ 在实际案例中，攻击者向 Apache ActiveMQ 服务发送特定数据包。该数据包包含 ExceptionResponse，其 Class 为 org.springframework.context.support.ClassPathXmlApplicationContext，Message 中包含 XML 有效载荷...
cloud-sniper
Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...
detux
Detux: The Multiplatform Linux Sandbox Introduction: Detux is a sandbox developed to do traffic analysis of the Linux malwares and capture the IOCs by doing so. QEMU hypervisor is used to emulate Linux Debian for various CPU architectures. The following CPUs are currently supported: x86 x86-64 AR...
log4shell-iocs
Log4Shell-IOCs 由WatchGuard Threat Lab策划的IOC源，包含最近尝试探测或利用Log4j2中CVE-2021-44228的行为 分析师评论 2021-12-17 此源中分享的威胁应用于THREAT HUNTING并添加到WATCHLIST。我们强烈建议NOT将其添加到阻止列表。...
log4j-CVE-2021-44228-Public-IoCs
Lista pública de IoCs de log4j log4shell CVE-2021-44228 IoCs públicos sobre log4j CVE-2021-44228 log4shell basados en Twitter y otras redes sociales se aceptan pull requests, elimino duplicados automáticamente IPs https://github.com/Sh0ckFR/log4j-CVE-2021-44228-Public-IoCs/raw/main/ips.txt Domini...
EITest-tools-scripts-IOCs
IOCs Indicators of Compromise IOCs updated every 30 minutes related to EITest campaigns. The domain stat-dns.com used in EITest's DGA algorithmhas been sinkholed. As a result, the EITest campaign now appears to have been shutdown since 2018-03-15. backend-decipher.py Decodes data transmitted from...
IOCScraper
IOC Scraper IOC Scraper utilises IOCPARSER service to fetch IOCs from different vendor Blogs, PDFs, and CSV files. Parsing IOCs is time-consuming process, using current script one can automatically extract and aggregate IOCs easily. Features Defanged IOCs : Supports extracting and defanging IOCs...
Malware-IOCs
Malware-IOCs Aquí es donde publicaré los IOCs de investigaciones de malware...
Malware-IOCs
Malware-IOCs Solo mis hallazgos de malware...
threat-research-and-intelligence
Blogs completos de inteligencia | Resultados de blogs | Resultados de informes | Charlas públicas ℹ️ :: Descripción general Este repositorio tiene como objetivo la difusión de IOCs, reglas YARA y código fuente de los informes de inteligencia sobre amenazas publicados por el equipo de BlackBerry...