IntelOwl is a production-grade, open-source threat intelligence platform that automates the analysis of observables (IPs, domains, URLs, hashes) and files (PE, PDF, APK, etc.) through a pluggable plugin system. The backend is built with Django REST Framework, Celery for asynchronous task execution, and Django Channels for real-time WebSocket updates. The frontend is a React single-page application using react-router, react-flow for pipeline visualizations, and Zustand for state management. The system supports multi-tenancy, organizations, role-based access, and integrates with dozens of external threat intelligence APIs and open-source analysis tools via containerized microservices. The architecture is centered around a plugin framework with five plugin types: analyzers (file and observable), connectors (push results to external systems), visualizers (render reports), pivots (create child jobs from analysis results), and ingestors (pull threat feeds). Playbooks bundle these plugins into repeatable analysis workflows. A data model manager normalizes analyzer outputs into structured evaluations with reliability scores, and a user event system allows manual verdict overrides with decay logic. The platform also includes an AI chatbot assistant powered by a local Ollama LLM and LangGraph, enabling natural-language queries and one-click analysis launches. Key operational features include a comprehensive REST API, token-based authentication with optional OAuth/LDAP/RADIUS, Elasticsearch for BI reporting, and Docker-based deployment with separate containers for specialized analyzers. The codebase is actively maintained with extensive unit and integration tests, CI/CD pipelines, and a large community (4695 stars). While the migration system is somewhat repetitive, the overall architecture is clean, modular, and demonstrates strong software engineering practices.
EmailAnalyzer is a command-line application for analyzing suspicious email files (.eml). It extracts headers, links, attachments, digests (hashes), and authentication results (SPF/DKIM/DMARC) from email messages. The tool provides investigation features that generate links to threat intelligence services (VirusTotal, AbuseIPDB, URLScan) for indicators of compromise found in emails. Output can be displayed in the terminal or saved as JSON or HTML reports. The architecture is modular with separate functions for each analysis component, all depending only on the Python standard library, making them highly reusable.
The LOLBAS project is a curated dataset of Windows binaries, scripts, and libraries that can be abused for malicious purposes (Living Off The Land Binaries and Scripts). Each entry is documented in YAML files with a standardized schema, including technical details, use cases, MITRE ATT&CK mappings, detection artifacts, and external references. The repository serves as a threat intelligence resource for offensive security research and defensive security operations, enabling threat hunting and detection rule development. Data is organized by file type (binaries, libraries, scripts) and maintained through community contributions with automated validation via Pydantic schemas.
Yeti is a threat intelligence platform that ingests, enriches, correlates, and stores cyber threat observables, entities, indicators (YARA, Sigma, Suricata, regex, forensic artifacts), and DFIQ investigative questions. It provides a FastAPI-based REST API for CRUD operations, graph traversal, semantic search (via ChromaDB), and RBAC. The system uses ArangoDB as its primary graph/document database, Redis for message brokering, and Celery for background task scheduling. It includes a plugin architecture for feeds (30+ public sources like MITRE ATT&CK, CISA KEV, MISP, AbuseIPDB) and analytics (Shodan, Censys, VirusTotal, etc.). The codebase is well-structured with clean abstractions (ArangoYetiConnector, event system, polymorphic schemas, migration framework) but contains deprecated plugins and some configuration drift. It is primarily an application, not a data research project.
This repository is a community-driven threat hunting and detection engineering knowledge base rather than a deployable application. It contains 26+ Windows-focused Jupyter notebooks (authored as Jupytext Markdown) that each follow a strict hypothesis-driven methodology: hypothesis, technical context, offensive tradecraft, pre-recorded security datasets, SQL/Pandas analytics, and Sigma rule output. The repo also includes deep Windows internals documentation, MITRE ATT&CK group profiles (CTI), pre-hunt data management guidance, and a small YARA signature set. The dominant character is data_research: the core artifacts are analytical notebooks, structured metadata, and threat intelligence data, with a hybrid component of Python build scripts that generate the Jupyter Book, table of contents, ATT&CK Navigator layers, and evaluation reports.
Nemesis is an offensive security data processing platform by SpecterOps that ingests, enriches, analyzes, and alerts on files collected during red team and DFIR operations. The system is architected as a suite of microservices orchestrated via Dapr (pub/sub, workflows, state management), with services implemented in Python (FastAPI), Go (Titus secret scanner), and C# (ILSpy .NET decompiler). Key data flows: files are ingested via a CLI (supporting Cobalt Strike, Mythic, Outflank connectors) or REST API, then processed through a Dapr workflow that performs basic analysis (magic, hashes), runs pluggable enrichment modules (PE, .NET, Chromium/DPAPI decryption, YARA, SQLite, containers), invokes the Titus secret scanner, and finally publishes findings and alerts. A React frontend with Hasura GraphQL provides a dashboard for file browsing, enrichment status, YARA management, LLM-based triage agents, and reporting. The platform is deployment-agnostic with Docker Compose and Helm charts for k8s. Notable technical depth includes a standalone DPAPI decryption library (nemesis_dpapi) with multiple storage backends and write-once semantics, a rule-based file linking engine, and an AI agent framework using pydantic-ai and LiteLLM.
PECmd is a command-line tool for parsing Windows prefetch (.pf) files. It processes single files or directories, outputs detailed information in console, JSON, CSV, or HTML formats, and supports features like Volume Shadow Copy processing and deduplication. The application is built with .NET using System.CommandLine for argument parsing, Serilog for logging, and the Prefetch library for core parsing logic. All logic resides in Program.cs, which handles argument processing, file enumeration, prefetch parsing, and output generation. The tool is actively maintained with recent commits and up-to-date dependencies, targeting both .NET Framework 4.7.2 and .NET 9.0 for broad compatibility.
This repository is a curated list of tools and resources for security incident response and digital forensics (DFIR). It is organized into categories such as adversary emulation, evidence collection, log analysis tools, memory analysis tools, and more. Each entry includes a link and a brief description. The project includes GitHub Actions workflows to automatically check for broken URLs in the documentation and to lint the README for spelling errors, ensuring the list remains accurate and well-maintained. The primary value of this repository lies in its comprehensive collection of DFIR resources, which serves as a reference for security analysts and teams. The maintenance workflows demonstrate a commitment to data quality by proactively validating links and checking for spelling errors, which is essential for a resource list that relies on external URLs. While the repository does not contain complex data pipelines or analytical code, it effectively fulfills its purpose as a reference list through structured markdown and automated upkeep.
This repository is a curated list of open-source AWS security tools, organized into categories such as defensive hardening, offensive testing, purple teaming, continuous auditing, DFIR, development security, S3 auditing, and training. It also includes a Packer-based build system to create an Amazon Machine Image (AMI) pre-loaded with many of the listed tools, alongside scripts for cloning tool repositories (install-tools.sh) and generating markdown tables from CSV data (arsenal-kreator.sh). The actual code in the repo is minimal—mainly configuration and simple shell scripts—and the core value is the comprehensive reference list. The AMI build is dated (last manifest from 2018) and many linked tools may have moved or become unmaintained, resulting in significant technical drift. The repo is more of a historic index than an actively developed software project.