Exchange_IOC_Hunter

ExchangeIOCHunter Description: Hunt for IOCs in IIS Logs - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 Artefacts Supported: C2 IP Addresses used for scanning and exploitation File Names observed in exploitation attempts Remote Code Execution RCE Usage: powershell...

odin

Odin Odin is a central IoC scanner based on Loki Table of Contents General Info Requirements Fetching Deploying Loki Collecting Parsing General Info This application Loki latest version and download it on all machines using a powershell script and run it then this app receives the respose from al...

muad-dib

Installation | Usage | Features | VS Code | CI/CD Version francaise Why MUAD'DIB? npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond. MUAD'DIB combines 22 parallel scanners 278 detection rules, a...

awesome-threat-intelligence

awesome-threat-intelligence A curated list of awesome Threat Intelligence resources A concise definition of Threat Intelligence: evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that c...

box-js

box.js A utility to analyze malicious JavaScript. Installation Simply install box-js from npm: npm install box-js --global box-js is also available: as a Cuckoo module see the integrations directory and Nwinternights/CuckooBoxjs; as a Dockerfile see integrations/README.md; as a package in distros...

mitaka

Mitaka Mitaka is a browser extension that makes your OSINT Open Source Intelligence search & scan easier. Key features: Auto IoC indicators of compromise selection with refanging. E.g. example.com to example.com, testatexample.com to [email protected], hxxp://example.com to http://example.co...

BlackLotusDetection

BlackLotusDetection Created to help detect IOCs for CVE-2022-21894: The BlackLotus campaign https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ This creates an output txt file in the c:\temp folder...

Live-Forensicator

🛡️ Forensicator Artifact Collector 🛡️ Cross-platform Forensic Artifact Collector Windows | Linux | macOS | Network Devices Collects forensic artifacts from live systems for analysis in Forensicator Core. Includes a built-in HTML report for quick triage and preliminary findings review. 🤔 About Live...

threat-intel

threat-intel This repository contains supplemental items including IOCs, and signatures discussed in Huntress blogposts, and other media. Organization This repository is organized by year, within that folder will be a subfolder named by the month and title of the media which is supported by its...

Loki-RS

Loki-RS A rewrite of Loki in Rust. High-performance, multi-threaded YARA & IOC scanner in a single binary. Status : Beta. Works, but still under active development. Features YARA scanning of files and process memory yara-x IOC matching MD5/SHA1/SHA256 hashes, filename patterns, C2 indicators...

cyberbro

Cyberbro A simple application that extracts your IoCs from garbage input and checks their reputation using multiple services. 🌐demo.cyberbro.net About Inspired by Cybergordon and IntelOwl. This project aims to provide a simple and efficient way to check the reputation of your observables using...

IOCs

This repository does not have a README...

agentic-ioc-scanner

agentic-ioc-scanner IOC scanner for agentic AI coding tools — detects Mini Shai-Hulud, Gemini CLI RCE, Cursor CVE-2026-26268, and DPRK PromptMink. A detection kit for compromise of agentic AI coding assistants Claude Code, Gemini CLI, Cursor and the dependencies they pull into your repos. Eleven...

OSweep

OSweep™ Don't Just Search OSINT. Sweep It. Description If you work in IT security, then you most likely use OSINT to help you understand what it is that your SIEM alerted you on and what everyone else in the world understands about it. More than likely you are using more than one OSINT service...

proxynotshell-IOC-Checker

proxynotshell-IOC-Checker Powershell script used to check for IOC's for CVE-2022-41040 and CVE-2022-41082 based on community research and Microsoft: GTESC The Sec Master Double Puslar Microsoft Security Resource Center Microsoft Security Blog The script may be updated to include more IOC's as mor...

log4j-ioc-detector

log4j Linux IoC Detector A basic Bash script to detect log4j Indicator of Compromise IoC in Linux. How to Use 1. Clone this repository: git clone https://github.com/santosomar/log4j-ioc-detector 2. Run the the log4jiocdetector.sh script, as demonstrated below: bash sudo log4jiocdetector.sh A basi...

SourcePoint

SourcePoint SourcePoint is a polymorphic C2 profile generator for Cobalt Strike C2s, written in Go. SourcePoint allows unique C2 profiles to be generated on the fly that helps reduce our Indicators of Compromise "IoCs" and allows the operator to spin up complex profiles with minimal effort. This...

threat-intel

threat-intel This repository contains IoCs related to Volexity public threat intelligence blog posts. Public blog posts related to these IoCs can be found on the Volexity website. In the past this repository was also used to store tools published by Volexity. These tools have now been moved into...

Fenrir

Fenrir Simple Bash IOC Scanner Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for the following Indicators of Compromise IOCs: Hashes MD5, SHA1 and SHA256 using md5sum, sha1sum, sha -a 256 File Names string - checked for substring of the full path, e.g...

Loki

I wrote a new Open Source YARA scanner called LOKI RS Rust. LOKI Python is now officially deprecated. Important Note This project is now in inactive maintenance mode. This means that while I merge pull requests for bug fixes and straightforward issues, I currently lack the time to add new feature...