Defund the Police.

list awesome static-analysis chinese dynamic-analysis awesome-list malware-analysis chinese-translation malware-research threat-sharing threatintel malware-samples analysis-framework automated-analysis network-traffic threat-intelligence domain-analysis malware-collection drop-ice

• Updated Jun 7, 2024

Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/

ssh security honeypot telnet sftp scp attacker threat-sharing threatintel kippo threat-analysis cowrie deception cowrie-ssh telnet-honeypot decoy

• Updated Nov 12, 2026
• Python

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

security intelligence cybersecurity fraud-management threat-hunting malware-analysis information-exchange misp threat-sharing threatintel stix fraud-prevention cti information-security information-sharing threat-analysis fraud-detection threat-intelligence threat-intel threat-intelligence-platform

• Updated Nov 11, 2026
• PHP

Your Everyday Threat Intelligence

intelligence enrichment dfir infosec threat-hunting threat-sharing threatintel

• Updated Oct 28, 2026
• Python

Extract and aggregate threat intelligence.

ioc osint dfir threat-hunting malware-research misp threat-sharing threatintel yara threat-analysis fraud-detection intelligence-gathering security-tools threat-intelligence soar indicators-of-compromise threat-feeds threat-intelligence-platform

• Updated May 26, 2026
• Python

Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.

graylog logging forensics dfir sysmon threat-hunting siem threat-sharing threatintel netsec sysinternals graylog-plugin forensic-analysis threat-analysis threat-intelligence humio mitre-attack sigma-rules forensicartifacts digitalforensics

• Updated Nov 5, 2023
• PowerShell

Defanged Indicator of Compromise (IOC) Extractor.

ioc library osint base64 decoding dfir malware-research threat-sharing threatintel yara threat-intelligence defang indicators-of-compromise ioc-extractor

• Updated Aug 28, 2024
• Python

Python library using the MISP Rest API

api api-client misp threat-sharing threatintel

• Updated Nov 9, 2026
• Python

Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension

chrome-extension security censys shodan osint incident-response whois dfir cert threat-hunting misp threat-sharing threatintel cve virustotal passivetotal threatminer circl alienvault ibm-xforce

• Updated Sep 8, 2018
• HTML

Personal compilation of APT malware from whitepaper releases, documents and own research

collection malware threat-hunting malware-analysis malware-research threat-sharing threat-modeling yara-rules threat-intelligence malware-detection

• Updated Feb 7, 2019

A (nearly) production ready Dockered MISP

docker security misp threat-sharing security-tools threat-intelligence

• Updated Jan 12, 2024
• Shell

TAXII server implementation in Python from EclecticIQ

python threat-sharing threatintel stix taxii cti taxii-server cyber-threat-intelligence

• Updated Mar 12, 2026
• Python

CIF v3 -- the fastest way to consume threat intelligence

security threat-hunting cif threat-sharing threatintel cifv3

• Updated Apr 20, 2023
• Python

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

grammars observable ipv4 threat-hunting malware-analysis malware-research threat-sharing threatintel iocs hacktoberfest threat-intelligence grammar-parser indicators-of-compromise cidr-range network-data parse-urls ioc-finder cidr-ranges

• Updated Oct 25, 2026
• Python

Automated Docker MISP container - Malware Information Sharing Platform and Threat Sharing

security malware dockerhub malware-analysis misp threat-sharing information-security threat-intelligence

• Updated Mar 23, 2021
• Dockerfile

This repository contains Malicious Indicator of Compromise (IOC) blocklist for MISP, firewall which is vital for cybersecurity professionals to enhance threat detection and improve incident response capabilities.

blocklist malware phishing trojan cybersecurity threat-hunting misp threat-sharing threatintel cve iocs cti malicious-domains firewall-rules threat-intelligence c2

• Updated Sep 17, 2025
• Python

TAXII client implementation from EclecticIQ

python threat-sharing threatintel stix taxii cti taxii-client

• Updated Sep 3, 2021
• Python

Automated Docker MISP container - Malware Information Sharing Platform and Threat Sharing

security malware dockerhub malware-analysis misp threat-sharing information-security threat-intelligence

• Updated Dec 29, 2023
• Dockerfile

A utility repo to assist with converting between MISP and STIX formats

conversion misp threat-sharing stix

• Updated Dec 22, 2020
• Python

Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .

ioc malware malware-research threat-sharing threatintel iocs hacktoberfest indicators fang defang indicators-of-compromise

• Updated Nov 3, 2026
• Python