zettelforge

ZettelForge The only agentic memory system built for cyber threat intelligence. When a senior analyst leaves, two or three years of context walks out with them — customer environments, prior investigations, actor TTPs, false-positive patterns, every hard-won "wait, we've seen this before."...

cyberbro

Cyberbro A simple application that extracts your IoCs from garbage input and checks their reputation using multiple services. 🌐demo.cyberbro.net...

iocx

IOCX Deterministic, Zero‑Risk IOC Extraction for Modern Security Pipelines Static IOC extraction from a PE file using the IOCX CLI Official IOCX Project This is the original IOCX engine for deterministic static IOC extraction and PE analysis. Any other repositories using the name "iocx" are not...

ThreatPad

ThreatPad A collaborative, real-time note-taking platform built for Cyber Threat Intelligence CTI and security operations teams. ThreatPad combines the speed of modern productivity tools with CTI-specific capabilities: IOC auto-extraction, STIX 2.1 export, structured threat templates, and...

mitaka

Mitaka Mitaka is a browser extension that makes your OSINT Open Source Intelligence search & scan easier. Key features: Auto IoC indicators of compromise selection with refanging. E.g. example.com to example.com, testatexample.com to [email protected], hxxp://example.com to http://example.co...

RansomCoinPublic

RansomCoin Extracting metadata and hardcoded Indicators of Compromise from ransomware, in a scalable, efficient, way with cuckoo integrations. Ideally, is it run during cuckoo dynamic analysis, but can also be used for static analysis on large collections of ransomware. Designed to be fast, with...

box-js

box.js A utility to analyze malicious JavaScript. Installation Simply install box-js from npm: root@kitploit: npm install box-js --global box-js is also available: as a Cuckoo module see the integrations directory and Nwinternights/CuckooBoxjs; as a Dockerfile see integrations/README.md; as a...

analyzer

该项目自动化了威胁情报分析师角色的日常任务在内部 ，无需外部资源交互。它通过使用不同的模块提取特征、工件和IoC，分析、可视化和结构化敏感 文件（恶意软件）或数据。这些模块的输出可以轻松集成到你的研究或SOC平台中。 安装 git clone https://github.com/qeeqbox/analyzer.git && cd analyzer && chmod +x run.sh && ./run.sh autoconfigure 界面 输出 APT-恶意软件 JSON\HTML 报告（+190 样本） 功能 本地运行（离线） 分析缓冲区、文件或完整文件夹 实时分析（会话已保存）...

detux

Detux：多平台Linux沙箱 简介： Detux是一个沙箱，用于对Linux恶意软件进行流量分析，并从中捕获IOC。它使用QEMU虚拟机管理程序来模拟不同CPU架构的Linux（Debian）。 目前支持以下CPU： x86 x86-64 ARM MIPS MIPSEL 立即使用在线版本：http://detux.org 此版本包含什么？ 此版本的Detux包含用于在指定CPU架构下执行Linux二进制文件/脚本的脚本。如果你不知道平台类型也不必担心，脚本内已集成Magic包，可自动识别CPU架构。x86是默认的CPU版本，可在配置文件中调整为其他架构。...

iocextract

iocextract Indicator of Compromise IOC extractor for some of the most commonly ingested artifacts. Table of contents Overview The Problem Our Solution Example Use Case Installation Usage Library Command Line Interface Helpful Information FAQ More Details Custom Regex Related Projects Contributing...

xioc

xioc Extract indicators of compromise from text, including "escaped" ones like hxxp://banana.com, 1.1.1.1 and phish at malicious dot com. Installation Download a precompiled binary from https://github.com/assafmo/xioc/releases Or... Use go get: root@kitploit: go get -u github.com/assafmo/xioc Or...

iocx

IOCX Extracción de IOC determinista y sin riesgo para pipelines de seguridad modernos Extracción estática de IOC de un archivo PE usando la CLI de IOCX Proyecto Oficial IOCX Este es el motor IOCX original para la extracción estática determinista de IOC y el análisis de PE. Cualquier otro...

IOCScraper

IOC Scraper IOC Scraper 利用 IOCPARSER 服务从不同厂商的博客、PDF 和 CSV 文件中获取 IOC。解析 IOC 是一个耗时过程，使用当前脚本可以轻松自动提取和聚合 IOC。 功能 去混淆 IOC：支持提取和去混淆 IOC。 白名单 IOC：支持自定义 IOC 白名单。 源类型：支持多种来源，如博客、PDF、CSV 等。 支持的 IOC 类型 IOC Scraper 支持多种 IOC 类型。 IOC 类型| 状态 ---|--- ASN| 支持 IPv4、IPv6| 支持 URL、域名| 支持 Email| 支持 MD5、SHA1、SHA256、文件名...

windows-malware-behavioral-analysis

Análisis de comportamiento de malware con REMnux y FLARE-VM Una investigación práctica de malware para el equipo azul que demuestra cómo se pueden analizar ejecutables sospechosos de Windows de forma segura dentro de un laboratorio aislado mediante técnicas de análisis de comportamiento. En lugar...

livewire-honeypot

Livewire 蜜罐 一个高交互蜜罐，伪装成存在漏洞的 Laravel/Livewire 应用程序。它能捕获针对已知 Livewire CVE 的漏洞利用尝试，存储上传的恶意文件（WebShell）和远程代码执行（RCE）负载，并通过 SHA-256 去重，还能选择性地在沙箱化的 Docker 容器中执行这些负载，以提取攻击指标（IOC）——即恶意软件试图联系的 URL、IP 和域名。 出于安全考虑，系统作为两个独立的进程运行：一个Web 服务器 （负责捕获负载，无 Docker 访问权限）和一个沙箱工作者 （负责在隔离容器中分析负载）。 工作原理 root@kitploit: 攻击者...

panrapidcheck

PAN Rapid Check Simpleyou should probably just do this in bash with grep PANOS support file checker that extracts some places to look for CVE-2024-3400 IoCs Generate the support file from Device - Support - Generate Tech Support file iocs.txt should include IPs/hosts from known bad for example...

iocx v0.7.6.1

IOCX Deterministic, Zero‑Risk IOC Extraction for Modern Security Pipelines Static IOC extraction from a PE file using the IOCX CLI Official IOCX Project This is the original IOCX engine for deterministic static IOC extraction and PE analysis. Any other repositories using the name "iocx" are not...

GHSA-FXGQ-9M89-CXJ9 eml_parser has a URL extraction bypass via HTML entities in URLs

Summary emlparser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML...

UPDATE: Cuckoo Sandbox 2.0.4

PenTestIT RSS Feed My previous post was about this open source, malware analysis automation framework - Cuckoo Sandbox 2.0.0. This post however, is about an update made to the framework. We now have Cuckoo Sandbox 2.0.4 which include a number of important improvements simplifying and improving yo...