threatresearch

A community-driven repository for threat hunting ideas, methodologies, and research that serves as a central gathering place for hunters to share knowledge, collaborate on techniques, and advance the field of threat hunting.

LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. This project gathers procedural examples from public reports of adversarial activities targeting ESXi hosts

A CTI program management and production platform built around MISP

Practical DFIR and incident response playbooks covering phishing, malware, ransomware, insider threats, and cloud security incidents for SOC and IR teams.

Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities.

Repository of tools, YARA rules, and code-snippets from Stairwell's research team.

Public CTI platform for tracking nation-state APT actors, campaigns, malware, IOCs, and threat activity.

🛡️ BLACKSHIELD - Enterprise Threat Intelligence Database. 276K+ malicious IPs, 11K+ CIDR ranges, 4.5K+ malicious ASNs from 233+ threat feeds. Automated C2 tracking, ransomware blocklist, Tor exit nodes, VPN/proxy IPs, enemy nation ranges, and bulletproof hosting detection.

A state-of-the-art attack surface management tool of professional grade

Automates searches to pull IOC data from 15 APIs against public databases and community threat intelligence services

Wiestell is a production-grade, Threat Intelligence Platform (TIP) designed for SOC analysts, threat hunters, and cybersecurity professionals. It aggregates indicators of compromise (IOCs) from 11 open-source threat feeds.

𝕯𝖊𝖆𝖙𝖍 - Focusing on Detection Engineering & Threat Hunting. There are other concepts here. Take a look!

Tactical Threat Intelligence & OSINT Extractor a high-performance, stealthy OSINT tool designed to scrape, extract, and analyze Indicators of Compromise (IOCs) strictly from X.com (Twitter). It leverages headless browser automation to monitor threat actors, security researchers, and malware campaigns in real-time.

performs static and dynamic analysis of websites to detect malicious patterns, obfuscation techniques, and threat indicators

ThreatCull downloads public blocklists, drops duplicates, private ranges and your own infrastructure, scores each indicator by how many independent sources list it, and serves the result to your firewalls, DNS servers and SIEM.

Static CTI brief, curated from over 142 feeds and updated periodically (daily, weekly).

Threat hunting and detection engineering project focused on Akira ransomware tradecraft, ATT&CK mapping, telemetry analysis, and behavioral Sigma rule development.

Centralized intelligence dashboard built in Obsidian, designed to correlate Threat Actors, Campaigns, Malware, Vulnerabilities, and MITRE ATT&CK techniques into a unified operational view.

Performed deep static analysis using tools like HxD, Cmder, HashCalc, BinText, XorSearch, FLOSS, UPX, and PEStudio to extract strings, identify file structure, detect obfuscation, and reveal indicators of compromise.

Blastoise (CyberNews Intelligence Agent)