yeti

Yeti Platform Yeti aims to bridge the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline for DFIR teams. It was born out of frustration of having to answer the question "where have I seen this artifact before?" or "how do I search for IOCs related t...

CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

CVE-2024-25600

creationtimestamp| type| source ---|---|--- 2024-02-20 10:17:30+00:00| exploited| https://t.me/thehackernews/4571 2024-02-20 10:44:45+00:00| exploited| Telegram/kHlRC3SWOIV4elFoTwQttUfL6OQGeloDKaQFUppAUyJ5Ww 2024-02-20 11:00:52+00:00| exploited| https://t.me/KomunitiSiber/1514 2024-02-20...

CVE-2022-26500

creationtimestamp| type| source ---|---|--- 2022-03-14 13:38:49+00:00| seen| https://t.me/ptswarm/115 2022-03-15 17:19:30+00:00| seen| https://t.me/cKure/9039 2022-03-16 14:51:00+00:00| exploited| https://t.me/itsecnews/315 2022-03-17 23:21:50+00:00| seen| https://t.me/cibsecurity/39170 2023-06-1...

Insider Risks In the Work-From-Home World

The employee who exfiltrated data after being fired. The employees who exposed 250 million customer records. The employee who stole trade secrets to get a leg up in his next job because hey, after all, it’s “his” work that he’s taking, right? Those are our traditional notions of insider risk and...

Open Distributed Threat Intelligence: Yeti

Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository. Yeti will also automatically enrich observables e.g. resolve domains, geolocate IPs so that you don’t have to. Yeti provides an interface for humans shiny...

Free Open Source Scalable Incident Response Platform: The Hive

Free Open Source Scalable Incident Response Platform TheHive is a scalable 3-in-1 open source and free solution designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. TheHi...

IRONGATE ICS Malware: Nothing to See Here...Masking Malicious Activity on SCADA Systems

In the latter half of 2015, the FireEye Labs Advanced Reverse Engineering FLARE team identified several versions of an ICS-focused malware crafted to manipulate a specific industrial process running within a simulated Siemens control system environment. We named this family of malware IRONGATE...

Misunderstanding APT Indicators of Compromise

Threatpost Op-Ed is a regular feature where experts contribute essays and commentary on what’s happening in security and privacy. Today’s contributors are Dave Dittrich and Katherine Carpenter. Reports of APT activities detail compromises spanning multiple organizations, sectors, industry...