ioc2rpz

ioc2rpz™ makes your threat intelligence actionable Table of Contents Short Summary Overview ioc2rpz™ is a place where threat intelligence meets DNS Architecture Overview How to use ioc2rpz™ ioc2rpz™ web interface Protocol Support Port Summary UDP Port 53 TCP Port 53 DNS over TLS / DoT Port 853 DN...

CVE-2022-26134

CVE-2022-26134 links root@kitploit: https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ fetched IP list from root@kitploit:...

Unit42-timely-threat-intel

Unit42-Timely-Threat-Intel This repository contains files with indicators supporting social media posts designed to disseminate timely threat intelligence data from Palo Alto Network's Unit 42 team. This information is provided "as is" to the public...

spiderfoot

SpiderFoot is an open source intelligence OSINT automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate. SpiderFoot has an embedded web-server for providing a clean and intuitive web-based...

SyntheticSun

SyntheticSun SyntheticSun es un marco de automatización y monitoreo de seguridad en profundidad que utiliza inteligencia de amenazas, aprendizaje automático, servicios de seguridad administrados de AWS y tecnologías sin servidor para prevenir, detectar y responder continuamente a las amenazas...

detections

Detecciones Este repositorio sirve como hogar para el contenido de detección desarrollado por el equipo de delivr.to. Todas las reglas presentes en este repositorio tienen payloads correspondientes enlazados en las referencias y mostrados a continuación que pueden utilizarse para probar el...

dsiem

Dsiem Dsiem es un motor de correlación de eventos de seguridad para ELK stack, que permite que la plataforma se utilice como un sistema SIEM dedicado y completo. Dsiem proporciona correlación al estilo OSSIM para registros/eventos normalizados, realiza consultas a fuentes de inteligencia de...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

beelzebub

Beelzebub Deception Runtime Framework Beelzebub is an open-source deception runtime that deploys adaptive, LLM-powered decoy services across SSH, HTTP, TCP, TELNET, and MCP protocols. It goes beyond passive honeypots by actively engaging attackers in realistic interactions, collecting high-fideli...

awesome-threat-intelligence

awesome-threat-intelligence Una lista curada de recursos increíbles de Threat Intelligence Una definición concisa de Threat Intelligence: conocimiento basado en evidencia, incluidos contexto, mecanismos, indicadores, implicaciones y consejos prácticos, sobre una amenaza o peligro existente o...

opensquat

openSquat Core 📑 Table of Contents What is openSquat? Featured In Open-Core Model Key Features Quick Start Requirements Usage Premium and API Modes Configuration Automation CLI Reference Contributing Author License 🎯 What is openSquat? openSquat is an Open Source Intelligence OSINT security tool...

Threat-Intelligence-Alerts

Threat Intelligence Alerts Our Threat Intelligence team uses a range of sources and tools to monitor external reporting and carry out a daily review of this intelligence to identify changes to the threat landscape which requires action internally, whether this is in the form of additional...

malcom

Malcom - Analizador de Comunicación de Malware Malcom es una herramienta diseñada para analizar la comunicación de red de un sistema utilizando representaciones gráficas del tráfico de red y cotejarlas con fuentes de malware conocidas. Esto resulta útil al analizar cómo ciertas especies de malwar...

Quantickle

Quantickle - Network Graph Visualization for Threat Intelligence A browser-based network graph visualization tool built on Cytoscape.js. Quantickle helps visualize and analyze connected data of any type, but is faceted towards threat intelligence. Installation Install instructions Table of Conten...

ToolShell-Honeypot

ToolShell-Honeypot SharePoint Zero-Day A Docker-based honeypot focused on detecting and logging exploitation attempts against Microsoft SharePoint zero-day vulnerabilities. This honeypot is designed for early detection and threat intelligence, not for simulating a full SharePoint environment or...

Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Threat actors are continuing to leverage artificial intelligence AI to streamline their operations, with one financially motivated hacking group employing an autonomous, multi-agent attack framework to carry out a large-scale credential harvesting campaign within six hours. Google Threat...

attackintel

ACTUALIZACIÓN 26 de noviembre de 2018 MITRE ha dejado obsoleta la funcionalidad de la API de ATT&CK y pronto la eliminará por completo. Han migrado a utilizar STIX. Mi código estará disponible como referencia, pero puedes echar un vistazo a mi aplicación web ATT&CK Intel, que está en fases...

strafer

Strafer Elasticsearch infections are rising exponentially. The adversaries are exploiting open and exposed Elasticsearch interfaces to trigger infections in the cloud and non-cloud deployments. During this talk, we will release a tool named "STRAFER" to detect potential infections in the...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark es el analizador de tráfico de red más utilizado. Es una herramienta importante tanto para el análisis de tráfico en vivo como para el análisis forense por parte de analistas de malware/forenses. Aunque Wireshark proporciona funcionalidades increíblemente...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...