$ show eset/malware-ioc
This repository is a curated collection of threat intelligence indicators of compromise (IOCs) published by ESET Research. It contains structured data for hundreds of malware families and APT campaigns, including file hashes (MD5, SHA1, SHA256), network indicators (domains, IPs, URLs), host-based artifacts (registry keys, file paths, mutexes), and detection rules (YARA, Sigma, Snort). The data is organized per-threat in consistent directory structures with README.adoc documentation, MISP event JSON exports, and plain hash lists. The repository serves as a reference for threat hunters, SOC analysts, and security researchers to detect and investigate known threats. While the data is static and time-sensitive, the detection rules and structured IOC formats are directly reusable in security tools and platforms.
The LLM identified 5 files worth highlighting for reuse:
A well-structured Sigma rule for detecting InvisiMole's EternalBlue exploitation activity. It follows the standard Sigma format with clear logsource, detection logic, and metadata. Reusable as a template for creating SIEM detections for similar TTPs.
A comprehensive YARA rule covering multiple SSH backdoor families (Abafar, Alderaan, etc.) with private rules for clean SSH binaries. Demonstrates advanced YARA techniques like condition-based string matching and is directly usable for scanning Linux systems.
A Python script for decrypting Carbon (Turla) files using CAST encryption. It is self-contained, well-commented, and can be adapted for decrypting similar malware payloads. Demonstrates non-obvious reverse engineering skill.
A Volatility plugin for extracting IOCs and configuration from Linux/Rakos malware memory samples. It is a reusable forensic tool that can be integrated into memory analysis workflows for similar Linux backdoors.
A Perl script for detecting compromised SSH binaries (Ebury) using binary string scanning. It is a standalone detection tool that can be reused by system administrators to audit SSH installations.