plast
plast ("Programme Libre d’Analyse STatique" in French) is a command-line and heavily modular threat-hunting tool. It comes with several modules that allow processing of multiple data sources, trigger automatic action(s) upon detection, and produce customized output. plast's engine uses YARA under the hood, leveraged through multiprocessing tasks to perform rule-based detection on multiple types of input. The main goal of the plast project is to provide an efficient and effortless way to detect indicators of compromise during incident-response operations. It provides a comprehensive framework that easily allows adding functionalities to the tool in just a few lines of code, without worrying about efficiency and scalability. plast embeds all referenced modules in one single tool, allowing it to be used on the field as a standalone utility. plast is entirely written in Python 3, making it compatible with all GNU/Linux, BSD, and macOS distributions. Nevertheless, some minimal dependencies are required. Note that running plast on Microsoft Windows operating systems is totally untested at the moment.
FEATURES
ALTERNATIVES
Tools to export data from MISP MySQL database for post-incident analysis and correlation.
Unified repository for Microsoft Sentinel and Microsoft 365 Defender containing security content, detections, queries, playbooks, and resources to secure environments and hunt for threats.
A tracker that detects and logs SYN packets with a specific signature generated by the Mirai malware, providing real-time information on Mirai-based campaigns.
Pulsedive is a threat intelligence platform that provides frictionless threat intelligence for growing teams, offering features such as indicator enrichment, threat research, and API integration.
A Python library for handling TAXII v1.x Messages and invoking TAXII Services.
In-depth analysis of real-world attacks and threat tactics
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Fabric Platform by BlackStork
Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.
Mandos Brief Newsletter
Stay ahead in cybersecurity. Get the week's top cybersecurity news and insights in 8 minutes or less.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.