Yara - The pattern matching swiss knife for malware researchers

•    C

---

YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic.

malware malware-analysis threat-analysis security virus

cowrie - Cowrie SSH/Telnet Honeypot

•    Python

---

This is the official repository for the Cowrie SSH and Telnet Honeypot effort. Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker.

cowrie honeypot ssh telnet security kippo cowrie-ssh telnet-honeypot sftp scp attacker threat-analysis threat-sharing threatintel

MISP - MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)

•    PHP

---

MISP, is an open source software solution for collecting, storing, distributing and sharing cyber security indicators and threat about cyber security incidents analysis and malware analysis. MISP is designed by and for incident analysts, security and ICT professionals or malware reverser to support their day-to-day operations to share structured informations efficiently. The objective of MISP is to foster the sharing of structured information within the security community and abroad. MISP provides functionalities to support the exchange of information but also the consumption of the information by Network Intrusion Detection System (NIDS), LIDS but also log analysis tools, SIEMs.

misp threat-sharing threat-hunting threatintel malware-analysis stix information-exchange fraud-management tip security cti cybersecurity fraud-detection fraud-prevention threat-analysis information-security information-sharing threat-intelligence threat-intelligence-platform intelligence

DeepFence - Identify vulnerabilities in running containers, images, hosts and repositories

•    Go

---

Deepfence ThreatMapper helps you to monitor and secure your running applications, in Cloud, Kubernetes, Docker, and Fargate Serverless. ThreatMapper scans your platforms and identifies pods, containers, applications, and infrastructure. Use ThreatMapper to discover the topology of your applications and attack surface. It obtains manifests of dependencies from running pods and containers, serverless apps, applications, and operating system. ThreatMapper matches these against vulnerability feeds to identify vulnerable components.

vulnerability-scanning security-vulnerability vulnerability-management threat-analysis vulnerability github docker kubernetes jenkins devops circleci gitlab serverless secops cloud-native security-tools devsecops compliance-automation registry-scanning

Apache Spot - A Community Approach to Fighting Cyber Threats

•    Java

---

Apache Spot is a community-driven cybersecurity project, built from the ground up, to bring advanced analytics to all IT Telemetry data on an open, scalable platform. pot expedites threat detection, investigation, and remediation via machine learning and consolidates all enterprise security data into a comprehensive IT telemetry hub based on open data models.

threat-analytics threat-detection threat-analysis cybersecurity threat machine-learning

graylog-plugin-threatintel - Graylog Processing Pipeline functions to enrich log messages with IoC information from threat intelligence databases

•    Java

---

This plugin adds Processing Pipeline functions to enrich log messages with threat intelligence data. Please read the usage instructions below for more information and specific guides.

graylog threat otx whois-information abuse graylog-plugin threatintel threat-score threat-analysis spamhaus whois whois-lookup

Phishruffus - Intelligent threat hunter and phishing servers

•    Python

---

Phishruffus is a tool designed for the identification of DNS servers and Internet threats used for the illegal practice of phishing.

phishing phishing-servers threat-intelligence threat-analysis

Vulnerability-Data-Archive - With the hope that someone finds the data useful, we're publishing an archive of almost all of the non-sensitive vulnerability information in our vulnerability reports database

•    

---

2018-01-30 Updated data. 2017-11-08 Updated data. Sorted JSON keys so future updates should diff more cleanly in git commit logs.

vulnerability-data vulnerability vulnerability-notes cert vulnerability-report threat-intelligence threatintel threat-analysis threat cve

BeSafe - BeSafe is robust threat analyzer which help to protect your desktop environment and know what's happening around you

•    CSharp

---

BeSafe is a robust threat analyzer which helps securing your desktop environment and be aware of what's happening around you. By using VirusTotal public API, BeSafe got power of more than 56 antivirus products without need to install any client engines in light and robust solution. Except VirusTotal's power, BeSafe uses other techniques and tricks to protect your environments from known and unknown threats. ❗️ Dependencies automatically handled by NuGet package manager of VisualStudio.

threat-analysis threat-hunting threat-intelligence cybersecurity malware-analysis