detux

Detux: The Multiplatform Linux Sandbox Introduction: Detux is a sandbox developed to do traffic analysis of the Linux malwares and capture the IOCs by doing so. QEMU hypervisor is used to emulate Linux Debian for various CPU architectures. The following CPUs are currently supported: x86 x86-64 AR...

threat-research

This repository contains IoCs and YARA rules related to Threatray's threat research, which can be found here: https://www.threatray.com/blog For updates, research highlights, and analysis insights, follow us on X Twitter: https://x.com/ThreatrayLabs The repository is organized per post, which...

pe-bear

PE-bear PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files. Signatures for PE-bear: SIG.txt updated: Oct 17, 2022 - contains signatures fromPEid's UserDB -...

log4j-CVE-2021-44228-Public-IoCs

log4j log4shell CVE-2021-44228 Public IoCs list Public IoCs about log4j CVE-2021-44228 log4shell based on Twitter and others social networks pull requests accepted, I remove duplicates automatically IPs https://github.com/Sh0ckFR/log4j-CVE-2021-44228-Public-IoCs/raw/main/ips.txt Callbacks domains...

Log4Shell_CVE-2021-44228_related_attacks_IOCs

Log4Shell（CVE-2021-44228）related attacks IOCs Source IPs attempting attacks using Apache Log4j RCE, including a large number of Tor nodes, see Attack-IP.md IOCs for malware, botnets, etc. propagated via the Log4j vulnerability, see IOC-C2.md Snort detection rules, see Snort.md Suricata rules, see...

Malware-IOCs

Malware Repository of Indicators of Compromise...

IOCScraper

IOC Scraper IOC Scraper utilises IOCPARSER service to fetch IOCs from different vendor Blogs, PDFs, and CSV files. Parsing IOCs is time-consuming process, using current script one can automatically extract and aggregate IOCs easily. Features Defanged IOCs : Supports extracting and defanging IOCs...

cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

gundog

gundog gundog - PowerShell based guided hunting in Microsoft 365 Defender Gundog provides you with guided hunting in Microsoft 365 Defender. Especially if not only for Email and Endpoint Alerts at the moment. Functionality You provide an AlertID you might received via Email notification and gundo...

EITest-tools-scripts-IOCs

IOCs Indicators of Compromise IOCs updated every 30 minutes related to EITest campaigns. The domain stat-dns.com used in EITest's DGA algorithmhas been sinkholed. As a result, the EITest campaign now appears to have been shutdown since 2018-03-15. backend-decipher.py Decodes data transmitted from...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

Kalim_Backdoor

Informe de Análisis de Malware Kalim Backdoor Este informe tratará sobre la funcionalidad del malware Kalim Backdoor. Tabla de Contenidos: - ¿Qué es una Backdoor? - Análisis Técnico. - Resumen. - Tácticas y Técnicas MITRE ATT&CK. - IOCs. - Regla Yara. ¿Qué significa Backdoor? Una backdoor es...

honeypot.rs

honeypot.rs Honeypot that scopes CVE-2023-46604 Apache ActiveMQ RCE Vulnerability and focused on getting Indicators of Compromise. This honeypot can be used in any Threat Intelligence infrastructure to get attacker's IP adresses, Post-Exploitation samples and malware samples. This information can...

log4shell-iocs

Log4Shell-IOCs IOC feeds curated by WatchGuard Threat Lab that contain recent attempts to probe or exploit CVE-2021-44228 in Log4j2 Analyst Comments 2021-12-17 Threats shared in this feed should be used for THREAT HUNTING and added to a WATCHLIST. We strongly recommend NOT adding them to a...

Malware-IOCs

Malware-IOCs This is where I'll post IOCs from malware investigations...

Malware-IOCs

Malware-IOCs Just my findings of malwares...

threat-research-and-intelligence

Full Intelligence Blogs | Blog Outcomes | Report Outcomes | Public Talks ℹ️ :: Overview This repository is for the dissemination of IOCs, YARA rules and source code from threat intelligence reports published by the BlackBerry Threat Research & Intelligence team. For fully detailed reports includin...

active_c2_ioc_public

+OPTIONS: ^: +TITLE: Active C2 IOCs Note Be careful with the firstseen/lastseen dates in each entry. Don't judge based on just an IP address...

iocs

Zscaler ThreatLabz IOCs This repository contains Indicators of Compromise IOCs from the Zscaler ThreatLabz team. Follow us on Twitter: @Threatlabz Blog: https://www.zscaler.com/blogs/security-research...

ioccheck

ioccheck A tool for simplifying the process of researching file hashes, IP addresses, and other indicators of compromise IOCs. Features Look up hashes across multiple threat intelligence services, from a single command or a few lines of Python. Currenty supports the following services: VirusTotal...