Malware Analysis

An open-source ICS/SCADA honeypot designed to emulate industrial control systems and collect adversary intelligence.

A distributed low-interaction honeypot with agent/master architecture for monitoring attacks across multiple protocols.

A low-interaction honeypot that emulates vulnerable services to capture malware and analyze attacks.

An extensible open-source framework for running, monitoring, and managing honeypots to detect and analyze cyber threats.

A centralized management and data collection server for deploying and monitoring multiple honeypot sensors.

A honeypot data normalizer that provides immutable persistence for hpfeeds, normalizes sensor data, and exposes it via a REST API.

A collection of nearly 40,000 JavaScript malware samples for security research and analysis.

A plugin-based malware crawler for collecting and pre-analyzing malware samples, useful for antivirus testing and malware analysis.

A live malware repository providing encrypted samples and source code for educational malware analysis and research.

An open-source framework for receiving, processing, and redistributing abuse feeds and threat intelligence.

A tool to gather and enrich threat intelligence indicators from publicly available sources into a structured CSV format.

A modular Python tool that collects threat intelligence from multiple sources for files identified by their hash.

A modular Python tool that collects threat intelligence for hosts (IPs, domains, FQDNs) from multiple sources and outputs CSV data.

A Python library and CLI for extracting and refanging defanged Indicators of Compromise (IOCs) from text.

Python library for creating, editing, and managing OpenIOC objects for threat intelligence indicators.

A modular malware and IOC ingestion framework that collects, enriches, and exports threat intelligence from multiple feeds.

A deprecated threat intelligence platform for collecting, processing, and sharing security indicators.

An open-source platform for collecting, storing, sharing, and acting upon cybersecurity threat intelligence and indicators.

A Python-based OpenIOC editor for creating and managing threat intelligence indicators across multiple security systems.

An extendable Python tool to extract and aggregate Indicators of Compromise (IOCs) from various threat intelligence feeds.

A Python script that monitors and alerts on indicators of compromise (IOCs) using Google Custom Search Engines and Safe Browsing APIs.

A tool for data visualization and statistical analysis of threat intelligence indicator feeds to measure their quality and effectiveness.

A collection of publicly shared Indicators of Compromise (IOCs) from FireEye for threat intelligence and security research.

A lightweight authenticated publish-subscribe protocol for binary data feeds, commonly used for security data sharing.

A comprehensive collection of Yara rules for malware detection, vulnerability identification, and security analysis.

A forensics intelligence platform that bridges CTI and DFIR by storing threat intelligence and enabling bulk observable searches and threat-focused analysis.