ThreatKB
ThreatKB is a knowledge base workflow management dashboard for YARA rules and C2 artifacts. Rules are categorized and used to denote intent, severity, and confidence in accumulated artifacts. To start using ThreatKB, check out our wiki. Installing by Docker is the currently recommended way of setting up ThreatKB, directions are included as the first link in the wiki. Installation by source is included in the wiki as well. ThreatKB utilizes Plyara to parse YARA rules into Python dictionaries. A huge thank you to the Plyara team! When a release is created, the system first pulls all signatures that are in the release state. Then, it gathers all signatures that are in the staging state and checks their revision history for the most recently released revision that is in the release state. If it finds it, it will include it in the release. If it does not find any previously released revisions, it will
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
The Ransomware Tool Matrix is a repository that lists and categorizes tools used by ransomware gangs, aiding in threat hunting, incident response, and adversary emulation.
QRadio is a tool/framework designed to consolidate cyber threats intelligence sources.
An extendable tool to extract and aggregate IOCs from threat feeds, integrates with ThreatKB and MISP.
Tools to export data from MISP MySQL database for post-incident analysis and correlation.
A tool for quick and effective Yara rule creation to isolate malware families and malicious objects.
AbuseHelper is an open-source framework for receiving and redistributing abuse feeds and threat intel.
A sophisticated npm attack attributed to North Korean threat actors, targeting technology firms and their employees.
Maldatabase is a threat intelligence platform providing malware datasets and threat intelligence feeds for malware data science and threat intelligence.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.