awesome-iocs

Curated sources of indicators of compromise, detection signatures and IOC tools.

GitHub Stars

Curated Resources

Use this list with your AI agent

Add the Context Awesome MCP server to Claude, Cursor, or any MCP client, then ask:

"Show me yara signatures resources from awesome-iocs"

advanced-threat-research/Yara-RulesYARA Signatures
YARA rules that accompany Trellix Advanced Threat Research (formerly McAfee ATR) blog posts and investigations.
aptnotes/dataIndicators
Index of public reports on APT campaigns sorted by year, useful for tracing indicators back to the original vendor reporting.
botherder/targetedthreatsIndicators
Network indicators from reports on the targeting of civil society, published as CSV, JSON and generated Snort rules.
CIRCL OSINT FeedIndicators
CIRCL's public MISP feed of indicators from open-source reporting, ready to subscribe to from a MISP instance.
Cisco-Talos/IOCsIndicators
IOCs from Cisco Talos.
citizenlab/malware-indicatorsIndicators
Indicators from Citizen Lab investigations into targeted attacks on civil society, one directory per report.

Awesome Detection Engineering
Designing, building and operating detection controls.
Awesome Incident Response
Tools and resources for security incident response.
Awesome Malware Analysis
Tools and resources for analyzing malware.
Awesome Threat Intelligence
Threat intelligence sources, formats and platforms.
Awesome YARA
YARA rules, tools and resources.

MISP Malware Information Sharing Platform & Threat Sharing formatIOC Formats
Specifications for the MISP core format and related formats, used to exchange indicators between MISP and other platforms.
MITRE Malware Attribute Enumeration and Characterization (MAEC™)IOC Formats
Schema for encoding malware behaviors, capabilities and attributes.
Neo23x0/yarGenIOC Tools
Generates YARA rules from malware samples while filtering out strings common in goodware.
ninoseki/mitakaIOC Tools
Browser extension that looks up a selected IOC across many OSINT and scanning services from the context menu.
OASIS Structured Threat Information Expression (STIX™)IOC Formats
A structured language and serialization format for exchanging cyber threat intelligence.
pedramamini/iocextractIOC Tools
Extracts IOCs from text, including defanged URLs, IP addresses and hashes.

Showing a sample of 40 resources. View the full list on GitHub →