Unit42-timely-threat-intel

Unit42-Timely-Threat-Intel This repository contains files with indicators supporting social media posts designed to disseminate timely threat intelligence data from Palo Alto Network's Unit 42 team. This information is provided "as is" to the public...

sigint-hombre

sigint-hombre Author: John Page — malvuln aka hyp3rlinx Copyright c 2026 Purpose: Generate derived Suricata detection rules from live URLhaus threat indicators at runtime and deploy them to the Security Onion platform for high-coverage real-time network monitoring. Current Version v2.0 • Major...

Noriben

Noriben Malware Analysis Sandbox Contact Information: @bbaskin on Twitter brian at thebaskins dot com Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you t...

glassworm-hunter

glassworm-hunter Detect GlassWorm supply chain attack payloads on your machine. Scans VS Code extensions, npm packages, Python packages, and git repositories. This scanner detects the attack technique itself - invisible Unicode variation selector payloads, GlassWorm decoder patterns, C2...

threat-team

Google Threat Intelligence Group Notice: This repository is no longer maintained. For the latest Indicators of Compromise IOCs and threat research, please refer to the Google Cloud Threat Intelligence blog and free Google Threat Intelligence / VirusTotal collections. This repository contains...

Unit42-Threat-Intelligence-Article-Information

Unit42-Threat-Intelligence-Article-Information This is the repository for indicators of compromise IOCs and other data supporting threat intelligence articles posted on the Palo Alto Networks Unit 42 website...

wiz-research-iocs

Wiz Research Public IOC Database This repo contains public indicators of compromise aggregated by Wiz Research...

wp-user-registration-vuln-checker

WordPress User Registration Checker for CVE-2026-1492 Read-only checker for owned WordPress sites that may be affected by CVE-2026-1492 in the User Registration & Membership plugin. It helps a site owner confirm plugin exposure and look for compromise indicators such as hidden administrator...

Log4j-IOCs

Log4j log4shell CVE-2021-44228 Public IOCs list Public IOCs about log4j CVE-2021-44228 IP List 45.83.64.237 92.223.89.187 45.83.67.157 45.83.66.8 51.210.175.24 51.75.161.78 185.220.101.62 139.177.178.141 45.83.66.111 94.23.251.77 51.210.175.87 68.183.198.247 185.107.56.121 147.182.154.110...

IoCs

IoCs Sophos-originated indicators-of-compromise from published reports /@&&@ . @ @ %@%, ./&@@&@@@@ @@ @%&@@& .@, @. @ @% @ && %@ .@@@@. &@&@//@& @/ @ @@ @ %@. ,%@@@@@@@@@&/ ., @% @@ @@,&@@ ,@ .@. @ , @& ,@@@@& .@ @ .@. @ .@ @& @@. %@@% ./. @,...

pftriage

pftriage pftriage es una herramienta para ayudar a analizar archivos durante el triaje de malware. Permite a un analista ver y extraer rápidamente propiedades de un archivo para ayudar durante el proceso de triaje. La herramienta también tiene una función de análisis que puede detectar indicadore...

IOCs

//////////////// ////////////////////// // //////////////////////// // /// /////// ///// /////// /////// /////// /////// //////// //////// //////// //////// //////// //////// //////// //////// //////// //////// /////// /////// /////// /////// ///// // ////// // // /////////////////////////...

BRIntelcollector

BRIntelcollector Overview The BRIntelcollector is a Cyber Threat Intelligence CTI tool focused on Brazilian national threat indicators. The tool allows searching and consolidating information about cyber threats through multiple intelligence sources, facilitating the creation of a centralized...

public-research

Nokia Deepfield ERT — public research Threat research from the Nokia Deepfield Emergency Response Team ERT, focused on DDoS botnets and related infrastructure. Each directory covers a botnet family with a brief summary and machine-readable indicators of compromise IoCs. This repo consolidates pri...

auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

Malware-IOCs

Malware Repository of Indicators of Compromise...

MOVEit_CVE-2023-34362_IOCs

MOVEit CVE-2023-34362 IOCs More information on Deep Instinct's blog site. Disclaimer The code provided is offered as-is and is intended for educational or informational purposes only. The user assumes all responsibility for the use of this code and any consequences that may arise from its use. Th...

maltrail

Maltrail Maltrail es un sistema de detección de tráfico de red que identifica la comunicación con infraestructura maliciosa conocida y reporta anomalías de tráfico seleccionadas. Compara dominios, URLs, direcciones IP, pares IP:port y valores de User-Agent observados en la red contra un conjunto ...

CVE-2021-44228_IoCs

CVE-2021-44228IoCs Public IoCs for log4j framework vulnerability CVE-2021-44228 log4shell based on multiple public sources...

citrix-2025

Detection Script for Citrix NetScaler appliances Author: NCSC-NL !WARNING Some of these checks are meant to hunt for compromises, while other checks verify if you are compromised. Disclaimer These scripts are provided without any guarantees regarding its effectiveness. The detection capabilities ...