xioc

xioc Extract indicators of compromise from text, including "escaped" ones like hxxp://banana.com, 1.1.1.1 and phish at malicious dot com. Installation Download a precompiled binary from https://github.com/assafmo/xioc/releases Or... Use go get: root@kitploit: go get -u github.com/assafmo/xioc Or...

Noriben

Noriben Malware Analysis Sandbox root@kitploit: Contact Information: @bbaskin on Twitter brian at thebaskins dot com Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, ...

0days-in-the-wild

0-days Exploited In-The-Wild This repository is a reference of documents about 0-day vulnerabilities detected as exploited in-the-wild. It includes both root cause analyses RCAs for each 0-day exploit as well as a table tracking each 0-day. These documents are intended to be viewed via the Github...

IOCs

//////////////// ////////////////////// // //////////////////////// // /// /////// ///// /////// /////// /////// /////// //////// //////// //////// //////// //////// //////// //////// //////// //////// //////// /////// /////// /////// /////// ///// // ////// // // /////////////////////////...

BRIntelcollector

BRIntelcollector Visión General El BRIntelcollector es una herramienta de Cyber Threat Intelligence CTI enfocada en indicadores de amenazas nacionales de Brasil. La herramienta permite buscar y consolidar información sobre amenazas cibernéticas a través de múltiples fuentes de inteligencia,...

auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

pftriage

pftriage pftriage es una herramienta para ayudar a analizar archivos durante el triaje de malware. Permite a un analista ver y extraer rápidamente propiedades de un archivo para ayudar durante el proceso de triaje. La herramienta también tiene una función de análisis que puede detectar indicadore...

MOVEit_CVE-2023-34362_IOCs

MOVEit CVE-2023-34362 IOCs More information on Deep Instinct's blog site. Disclaimer The code provided is offered as-is and is intended for educational or informational purposes only. The user assumes all responsibility for the use of this code and any consequences that may arise from its use. Th...

public-research

Nokia Deepfield ERT — public research Threat research from the Nokia Deepfield Emergency Response Team ERT, focused on DDoS botnets and related infrastructure. Each directory covers a botnet family with a brief summary and machine-readable indicators of compromise IoCs. This repo consolidates pri...

maltrail

Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...

Unit42-timely-threat-intel

Unit42-Timely-Threat-Intel This repository contains files with indicators supporting social media posts designed to disseminate timely threat intelligence data from Palo Alto Network's Unit 42 team. This information is provided "as is" to the public...

CVE-2019-19781_IOCs

CVE-2019-19781IOCs IOCs for CVE-2019-19781 citrixhoneypotnslookup.txt contains whois results for the IP addresses listed in ips.txt. these were the addresses that showed up most frequently in the logs of the honeypot discussed here:...

sigint-hombre

sigint-hombre Author: John Page — malvuln aka hyp3rlinx Copyright c 2026 Purpose: Generate derived Suricata detection rules from live URLhaus threat indicators at runtime and deploy them to the Security Onion platform for high-coverage real-time network monitoring. Current Version v2.0 • Major...

Log4j-IOCs

Log4j log4shell CVE-2021-44228 Public IOCs list Public IOCs about log4j CVE-2021-44228 IP List root@kitploit: 45.83.64.237 92.223.89.187 45.83.67.157 45.83.66.8 51.210.175.24 51.75.161.78 185.220.101.62 139.177.178.141 45.83.66.111 94.23.251.77 51.210.175.87 68.183.198.247 185.107.56.121...

glassworm-hunter

glassworm-hunter Detect GlassWorm supply chain attack payloads on your machine. Scans VS Code extensions, npm packages, Python packages, and git repositories. This scanner detects the attack technique itself - invisible Unicode variation selector payloads, GlassWorm decoder patterns, C2...

CVE-2022-22972-

CVE-2022-22972-IOC List IP ADRESSES • 23.36.163.250 • 64.32.6.143 • 217.175.49.100 HASH • 6f17c8af555321cca16fe1695cc420eb9079fd187b8fa71d840f3cfd1f796117 • 040db8eacbd482c12ba03ab1a7c738be • 97ac734b671c815c43ea3287732046d2177e5bdad63e12315acc4902b8baa04d •...

cve-2023-4966-iocs

Scan for CVE-2023-4966 IoCs Script: check-cve-2023-4966.py The script searches the Citrix NetScaler logs for possible CVE-2023-4966 exploitation. Usage root@kitploit: usage: check-cve-2023-4966.py -h --nologline logdirpath Python script to check CitrixNetScaler logs for possible CVE-2023-4966...

CVE-2021-44228_IoCs

CVE-2021-44228IoCs Public IoCs for log4j framework vulnerability CVE-2021-44228 log4shell based on multiple public sources...

investigations

Investigations This repository contains indicators of compromise extracted from some of Amnesty International's technical investigations in targeted threats against human rights defenders. These indicators are shared under the license CC-BY...

citrix-2025

Detection Script for Citrix NetScaler appliances Author: NCSC-NL !WARNING Some of these checks are meant to hunt for compromises, while other checks verify if you are compromised. Disclaimer These scripts are provided without any guarantees regarding its effectiveness. The detection capabilities ...