└── README.md


/README.md:
--------------------------------------------------------------------------------
  1 | # Threat Intelligence Documents For SOC
  2 | 
  3 | ## CMC SOC TEAM (CMC INFOSEC)
  4 | 
  5 | ## Pentest, hacking awesome resource
  6 | 
  7 | <https://github.com/Hack-with-Github/Awesome-Hacking>
  8 | 
  9 | <https://github.com/vitalysim/Awesome-Hacking-Resources>
 10 | 
 11 | <https://github.com/jekil/awesome-hacking>
 12 | 
 13 | <https://github.com/enaqx/awesome-pentest>
 14 | 
 15 | <https://github.com/coreb1t/awesome-pentest-cheat-sheets>
 16 | 
 17 | ### ARM Exploit
 18 | 
 19 | <http://www.freebuf.com/articles/terminal/107276.html>
 20 | 
 21 | Litecoin mining tutorial under Linux
 22 | 
 23 | <https://blog.linuxeye.cn/385.html>
 24 | 
 25 | Linux Lite LTC CPU Mining Tutorial
 26 | 
 27 | <http://www.iitshare.com/linux-litecoin-ltc-mining-tutorial.html>
 28 | 
 29 | Ethereum Linux system mining tutorial
 30 | 
 31 | <http://www.8btc.com/gpu-mining>
 32 | 
 33 | Litecoin ltc mining tutorial: cpu mining and gpu mining (detailed graphic)
 34 | 
 35 | <http://www.mnw.cn/news/digi/699354.html>
 36 | 
 37 | ### Office Malware Exploit
 38 | 
 39 | <https://github.com/Screetsec/Microsploit>
 40 | 
 41 | <https://remnux.org/>
 42 | 
 43 | <https://spreadsecurity.github.io/2016/08/14/macro-malware-analysis.html>
 44 | 
 45 | <http://sites.utexas.edu/iso/2016/07/08/reverse-engineering-a-malicious-ms-word-document/>
 46 | 
 47 | <http://www.freebuf.com/articles/terminal/74921.html>
 48 | 
 49 | <https://www.anquanke.com/post/id/84105>
 50 | 
 51 | <https://countuponsecurity.com/2014/09/22/malicious-documents-pdf-analysis-in-5-steps/>　
 52 | 
 53 | <https://countuponsecurity.com/2014/10/24/malicious-documents-word-with-vba-and-powershell/>
 54 | 
 55 | <https://www.cert-ist.com/public/en/SO_detail?code=malicious_pdf>　　　
 56 | 
 57 | <https://blog.didierstevens.com/category/pdf/>　　　　
 58 | 
 59 | <http://www.itbaby.me/blog/59f7ea965d21b31fcd4e2037>　　　　
 60 | 
 61 | <https://zeltser.com/media/docs/analyzing-malicious-document-files.pdf>　　　
 62 | 
 63 | <https://paper.seebug.org/351/>　　
 64 | 
 65 | <https://r3mrum.wordpress.com/2017/06/29/analyzing-malicious-password-protected-office-documents/>
 66 | 
 67 | <https://dfir.it/blog/2015/06/17/analysts-handbook-analyzing-weaponized-documents/>
 68 | 
 69 | <https://zeltser.com/analyzing-malicious-documents/>
 70 | 
 71 | <https://www.shellntel.com/blog/2016/9/13/luckystrike-a-database-backed-evil-macro-generator>
 72 | 
 73 | <https://www.blackhillsinfosec.com/hide-payload-ms-office-document-properties/>
 74 | 
 75 | <https://securityoversimplicity.wordpress.com/2017/11/23/not-all-she-wrote-part-3-rigged-rtf-documents/>
 76 | 
 77 | <http://www.sdkhere.com/2017/12/analysis-of-file-spider-ransomware.html>
 78 | 
 79 | <https://pentestlab.blog/2017/12/15/microsoft-office-payloads-in-document-properties/>
 80 | 
 81 | <http://www.freebuf.com/vuls/159789.html>
 82 | 
 83 | <http://blog.safedog.cn/?p=1519>
 84 | 
 85 | <http://blog.safedog.cn/?p=2209>
 86 | 
 87 | ## Malware Sample/Analyst
 88 | 
 89 | <https://github.com/wtsxDev/Malware-Analysis>
 90 | 
 91 | <https://github.com/vduddu/Malware>
 92 | 
 93 | <https://github.com/0xBADBAC0N/malware>
 94 | 
 95 | <https://github.com/ByteHackr/MalwareAnalysis>
 96 | 
 97 | <https://github.com/CHYbeta/Software-Security-Learning>
 98 | 
 99 | <https://zeltser.com/malware-sample-sources/>
100 | 
101 | <https://github.com/CHEF-KOCH/malware-research>
102 | 
103 | <http://www.kernelmode.info/forum/viewtopic.php?f=16&t=308>
104 | 
105 | <https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/>
106 | 
107 | <https://practicalmalwareanalysis.com/labs/>
108 | 
109 | <https://cybersecweb.wordpress.com/2016/07/12/malware-analysis-labs/> (\*\*)
110 | 
111 | <http://www.freebuf.com/articles/network/88798.html>
112 | 
113 | <https://www.52pojie.cn/thread-411742-1-1.html>
114 | 
115 | <https://www.botfrei.de/de/ransomware/galerie.html>
116 | 
117 | <https://cysinfo.com/category/training/advanced-malware-analysis/>
118 | 
119 | <https://blogs.cisco.com/security/talos/reversing-multilayer-net-malware>
120 | 
121 | ### Analyzing Linux Malwares
122 | 
123 | <https://malware-unplugged.blogspot.com/2015/11/limon-sandbox-for-analyzing-linux.html>
124 | 
125 | <https://github.com/Tencent/HaboMalHunter>
126 | 
127 | <https://www.blackhat.com/docs/eu-15/materials/eu-15-KA-Automating-Linux-Malware-Analysis-Using-Limon-Sandbox-wp.pdf>
128 | 
129 | <https://www.youtube.com/watch?v=fSCKyF--tRs&feature=youtu.be>
130 | 
131 | <http://contagiodump.blogspot.com/>
132 | 
133 | <http://dasmalwerk.eu/>
134 | 
135 | <http://www.freetrojanbotnet.com/>
136 | 
137 | <https://malshare.com/>
138 | 
139 | <http://www.kernelmode.info/forum/viewforum.php?f=16>
140 | 
141 | <https://avcaesar.malware.lu/>
142 | 
143 | <http://www.malwareblacklist.com/showMDL.php>
144 | 
145 | <http://thezoo.morirt.com/>
146 | 
147 | <https://malwr.com/>
148 | 
149 | <http://openmalware.org/>
150 | 
151 | <http://www.virusign.com/>
152 | 
153 | <https://virusshare.com/>
154 | 
155 | ### WMI POWERSHELL mining
156 | 
157 | <http://www.freebuf.com/articles/network/163233.html>
158 | 
159 | ### CoinMiner
160 | 
161 | Linux. mining. cpuminer method record
162 | <http://www.bubuko.com/infodetail-2167951.html>
163 | 
164 | Centos 6.3 64-bit cpuminer +mining_proxy Mining Litecoin (LTC) tutorial
165 | <https://www.cnblogs.com/sixiweb/archive/2013/12/02/3454564.html>
166 | 
167 | Compile CPUminer under Linux Centos
168 | <https://rumorscity.com/2014/01/04/compile-and-install-cpuminer-on-linux-centos/>
169 | 
170 | Build a Redis&Minerd Security Emergency Walkthrough Environment
171 | <http://www.freebuf.com/sectool/156904.html>
172 | 
173 | coinotron
174 | <https://www.coinotron.com>
175 | 
176 | ### Ransomware analysis report
177 | 
178 | File-Locker Ransomware
179 | <https://www.bleepingcomputer.com/news/security/file-locker-ransomware-targets-korean-victims-and-asks-for-50k-won/>
180 | 
181 | Layered spinning - GlobeImposter ransomware analysis
182 | <https://bbs.ichunqiu.com/thread-30152-1-1.html>
183 | 
184 | Gently take off your clothes - the macro virus's posture
185 | <https://bbs.ichunqiu.com/thread-29739-1-2.html>
186 | 
187 | Secret Chimera ransomware
188 | <http://www.freebuf.com/articles/system/112142.html>
189 | 
190 | Preliminary analysis of ransomware ZEPTO
191 | <http://www.freebuf.com/articles/system/112328.html>
192 | 
193 | The new malicious ransomware cuteRansomware
194 | <http://www.freebuf.com/news/109242.html>
195 | 
196 | Analysis of ransomware SkidLocker using AES-256 encryption algorithm
197 | <http://www.freebuf.com/articles/terminal/99153.html>
198 | 
199 | Reverse analysis of NanoLocker ransomware
200 | <http://www.freebuf.com/articles/network/94595.html>
201 | 
202 | New malicious ransomware DMA Locker analysis
203 | <http://www.freebuf.com/articles/network/96738.html>
204 | 
205 | Locky ransomware malicious sample analysis 2
206 | <http://www.ithtw.com/thread-8888.htm>
207 | 
208 | Locky ransomware malicious sample analysis 1
209 | <http://blog.topsec.com.cn/ad_lab/locky%E5%8B%92%E7%B4%A2%E8%BD%AF%E4%BB%B6%E6%81%B6%E6%84%8F%E6%A0%B7%E6%9C%AC%E5%88%86%E6%9E%90/>
210 | 
211 | IoT Security: Debugging Environment Building Tutorial (AArch64)
212 | <https://bbs.pediy.com/thread-229581.htm>
213 | 
214 | ### Malware VM
215 | 
216 | <https://0x4954.wordpress.com/2017/12/03/dfir-tips-malwarevbr-vm/>
217 | 
218 | ## Malware sites detection
219 | 
220 | <https://www.hybrid-analysis.com> (recmt)
221 | 
222 | <https://any.run> (recmt)
223 | 
224 | <https://www.virustotal.com> (recmt)
225 | 
226 | <https://virusscan.jotti.org>
227 | 
228 | <http://virscan.org>
229 | 
230 | <https://id-ransomware.malwarehunterteam.com>
231 | 
232 | <https://www.vmray.com>
233 | 
234 | <http://www.threatexpert.com/submit.aspx>
235 | 
236 | <https://www.reverse.it>
237 | 
238 | <https://www.maldun.com/submit/submit_file>
239 | 
240 | <https://habo.qq.com>
241 | 
242 | <https://www.joesandbox.com>
243 | 
244 | ## Malware sources
245 | 
246 | <https://github.com/gbrindisi/malware>
247 | 
248 | <https://github.com/kaiserfarrell/malware>
249 | 
250 | <https://github.com/terrorisst/Malware>
251 | 
252 | <https://github.com/fdiskyou/malware>
253 | 
254 | <https://github.com/c633/malwaRE>
255 | 
256 | <https://github.com/DanielRTeixeira/Malware>
257 | 
258 | <https://github.com/nikicat/web-malware-collection>
259 | 
260 | <https://github.com/faber03/AndroidMalwareEvaluatingTools>
261 | 
262 | <https://github.com/gasgas4/Leaked_Malware_SourceCode>
263 | 
264 | <https://github.com/ashishb/android-malware>
265 | 
266 | <https://github.com/infosecguerrilla/LinuxMalwareSourceCode>
267 | 
268 | <https://github.com/tfairane/AndroMalware>
269 | 
270 | <https://github.com/infosecguerrilla/WindowsMalwareSourceCode>
271 | 
272 | <https://github.com/csurage/Rootkit>
273 | 
274 | <https://github.com/adi0x90/POC-Android-Malware>
275 | 
276 | <https://github.com/cheverebe/Android-malware>
277 | 
278 | <https://github.com/ispoleet/malware>
279 | 
280 | <https://github.com/bakely/malware>
281 | 
282 | <https://github.com/K1rky/Malware>
283 | 
284 | <https://github.com/Screetsec/TheFatRat>
285 | 
286 | <https://github.com/asudhak/Android-Malware>
287 | 
288 | <https://github.com/Xyl2k/Malware-Auto-Downloader>
289 | 
290 | <https://github.com/slydon/malware_tools>
291 | 
292 | <https://github.com/Mi3Security/su-a-cyder>
293 | 
294 | <https://github.com/pandazheng/POC-Android-Malware-files>
295 | 
296 | <https://github.com/tfairane/AndroMalware>
297 | 
298 | <https://github.com/eset/malware-research>
299 | 
300 | <https://github.com/m0nad/Diamorphine>
301 | 
302 | <https://github.com/a7vinx/liinux>
303 | 
304 | ### Malware Book
305 | 
306 | <https://github.com/RPISEC/Malware>
307 | 
308 | <https://github.com/rshipp/awesome-malware-analysis>
309 | 
310 | <https://github.com/mgoffin/malwarecookbook>
311 | 
312 | <https://github.com/MISP/MISP>
313 | 
314 | <https://github.com/wyyqyl/MalwareAnalysis>
315 | 
316 | <https://github.com/secmobi/amatutor>
317 | 
318 | <https://github.com/pandazheng/amatutor>
319 | 
320 | ## Yara for hunting
321 | 
322 | <https://github.com/AlienVault-OTX/yabin>
323 | 
324 | <http://autopsit.blogspot.com/2015/12/using-virustotal-hunting-with-yara.html>
325 | 
326 | <https://blog.nviso.be/2017/02/14/hunting-with-yara-rules-and-clamav/>
327 | 
328 | <https://github.com/InQuest/awesome-yara>
329 | 
330 | <https://bbs.pediy.com/thread-223070.htm>
331 | 
332 | <https://github.com/nbs-system/php-malware-finder>
333 | 
334 | <https://github.com/mitre/multiscanner>
335 | 
336 | <http://www.freebuf.com/articles/system/26373.html>
337 | 
338 | <https://github.com/plusvic/yara/releases/tag/v2.0.0>
339 | 
340 | <https://yara.readthedocs.io/en/v3.5.0/gettingstarted.html>
341 | 
342 | <https://analysis.yararules.com/>
343 | 
344 | <https://github.com/Yara-Rules/rules>
345 | 
346 | <https://www.bsk-consulting.de/2015/02/16/write-simple-sound-yara-rules/>
347 | 
348 | <https://www.bsk-consulting.de/2015/10/17/how-to-write-simple-but-sound-yara-rules-part-2/>
349 | 
350 | <https://www.bsk-consulting.de/2016/04/15/how-to-write-simple-but-sound-yara-rules-part-3/>
351 | 
352 | <http://blog.safedog.cn/?p=281>
353 | 
354 | ## Docker for analyst
355 | 
356 | <https://github.com/eliasgranderubio/dagda>
357 | 
358 | <https://digital-forensics.sans.org/blog/2014/12/10/running-malware-analysis-apps-as-docker-containers>
359 | 
360 | <https://holisticinfosec.blogspot.com/2015/07/toolsmith-malware-analysis-with-remnux.html>
361 | 
362 | <https://www.blackhat.com/docs/eu-15/materials/eu-15-Bettini-Vulnerability-Exploitation-In-Docker-Container-Environments.pdf>
363 | 
364 | <https://blog.rootshell.be/2016/02/22/incident-handling-docker-to-the-rescue/>
365 | 
366 | Docker malware analysis series first Docker
367 | <http://blog.sina.com.cn/s/blog_e8e60bc00102vl37.html>
368 | 
369 | Docker malware analysis series II: client risk analysis
370 | <http://blog.sina.com.cn/s/blog_e8e60bc00102vlq7.html>
371 | 
372 | Docker malware analysis series III: APK and analyze information using Trojan Viper
373 | <http://blog.sina.com.cn/s/blog_e8e60bc00102vm2p.html>
374 | 
375 | Docker malware analysis series ⅳ: js anti-aliasing analysis
376 | <http://blog.sina.com.cn/s/blog_e8e60bc00102vmwi.html>
377 | 
378 | Docker malware analysis series V: ALICTF finals design
379 | <http://blog.sina.com.cn/s/blog_e8e60bc00102vnr0.html>
380 | 
381 | Docker malware analysis series VI: ALICTF finals Solution ideas
382 | <http://blog.sina.com.cn/s/blog_e8e60bc00102vnr6.html>
383 | 
384 | ## Script
385 | 
386 | <https://github.com/znb/Malware>
387 | 
388 | <https://github.com/arbor-jjones/malware>
389 | 
390 | <https://github.com/samvartaka/malware>
391 | 
392 | <https://github.com/John-Lin/malware>
393 | 
394 | <https://github.com/PythonWebScrapingMalware/Malware>
395 | 
396 | <https://github.com/sroberts/malwarehouse>
397 | 
398 | <https://github.com/SpiderLabs/malware-analysis>
399 | 
400 | <https://github.com/hasherezade/malware_analysis>
401 | 
402 | <https://github.com/tomchop/malcom>
403 | 
404 | <https://github.com/JustF0rWork/malware>
405 | 
406 | <https://github.com/seifreed/malware-scripts>
407 | 
408 | <https://github.com/andrew-morris/stupid_malware>
409 | 
410 | <https://github.com/abdesslem/malwareHunter>
411 | 
412 | <https://github.com/dchad/malware-detection>
413 | 
414 | <https://github.com/bindog/ToyMalwareClassification>
415 | 
416 | <https://github.com/svent/jsdetox>
417 | 
418 | <https://github.com/Googulator/TeslaCrack>
419 | 
420 | <https://github.com/KoreLogicSecurity/mastiff>
421 | 
422 | <https://github.com/adobe-security/Malware-classifier>
423 | 
424 | <https://github.com/PaloAltoNetworks/WireLurkerDetector>
425 | 
426 | <https://github.com/necst/aamo>
427 | 
428 | <https://github.com/maltelligence/maltelligence>
429 | 
430 | <https://github.com/mwleeds/android-malware-analysis>
431 | 
432 | <https://github.com/trendmicro/aleph>
433 | 
434 | <https://github.com/idanr1986/cuckoo-droid>
435 | 
436 | <https://github.com/MalwareLu/tools>
437 | 
438 | <https://github.com/hgascon/adagio>
439 | 
440 | <https://github.com/rieck/malheur>
441 | 
442 | <https://github.com/dcmorton/MalwareTools>
443 | 
444 | <https://github.com/ispoleet/malware>
445 | 
446 | <https://github.com/Dynetics/Malfunction>
447 | 
448 | <https://github.com/tiago4orion/malelf>
449 | 
450 | <https://github.com/lbull/malware-collector>
451 | 
452 | <https://github.com/sysopfb/Malware_Scripts>
453 | 
454 | <https://github.com/deadbits/malware-analysis-scripts>
455 | 
456 | <https://github.com/tuomao/android_malware_detection>
457 | 
458 | <https://github.com/aim4r/VolDiff>
459 | 
460 | <https://github.com/VT-Magnum-Research/antimalware>
461 | 
462 | <https://github.com/devwerks/Static-Malware-Analyses>
463 | 
464 | <https://github.com/guelfoweb/peframe>
465 | 
466 | <https://github.com/nheijmans/malzoo>
467 | 
468 | <https://github.com/neriberto/hg>
469 | 
470 | <https://github.com/mboman/mart>
471 | 
472 | <https://github.com/CSIRTUK/Malware-Tools>
473 | 
474 | <https://github.com/0x71/cuckoo-linux>
475 | 
476 | <https://github.com/bunseokbot/androtools>
477 | 
478 | <https://github.com/psdeshpande/MalwareDetection>
479 | 
480 | <https://github.com/sibichakkaravarthy/Malware-Analysis>
481 | 
482 | <https://github.com/2015-10-10/MalwareClassification>
483 | 
484 | <https://github.com/pfohjo/nitro>
485 | 
486 | <https://github.com/researcherGeekLab/AMIV>
487 | 
488 | <https://github.com/Te-k/malware-classification>
489 | 
490 | <https://github.com/lanninghuanxue/DroidJ>
491 | 
492 | <https://github.com/CvvT/AppTroy>
493 | 
494 | <https://github.com/monnappa22/Limon>
495 | 
496 | <https://github.com/androguard/androguard>
497 | 
498 | <https://github.com/sh4hin/Androl4b>
499 | 
500 | <https://github.com/jnferguson/entropyDeviation>
501 | 
502 | ## APT Note
503 | 
504 | <https://github.com/kbandla/APTnotes>
505 | 
506 | <https://github.com/hfiref0x/CVE-2015-1701>
507 | 
508 | <https://github.com/michael-yip/APTMalwareNotes>
509 | 
510 | <https://github.com/abzcoding/aptdetector>
511 | 
512 | <https://github.com/harsh2602/APT-Detection-Via-Graph-Analytics>
513 | 
514 | <https://github.com/Tryan18/XCOM>
515 | 
516 | <https://github.com/aroradhruv03/APThreatDetectionSys>
517 | 
518 | <https://github.com/tobypinder/ludumdare32>
519 | 
520 | <https://github.com/hslatman/awesome-threat-intelligence>
521 | 
522 | <https://github.com/peterfelfer/AtomProbeTutorials>
523 | 
524 | <https://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html>
525 | 
526 | ## Linux distro
527 | 
528 | DEFT (Digital Evidence & Forensic Toolkit): <http://www.deftlinux.net/>
529 | 
530 | CAINE: <https://www.caine-live.net/>
531 | 
532 | BLACKARCH: <http://samurai.inguardians.com/>
533 | 
534 | ArchStrike: <https://archstrike.org/>
535 | 
536 | SANTOKU Linux: <https://santoku-linux.com/>
537 | 
538 | SANS SIFT: <https://digital-forensics.sans.org/community/downloads>
539 | 
540 | ## Hunting
541 | 
542 | <https://holdmybeersecurity.com/2018/01/16/part-2a-intro-to-threat-hunting-with-kolide-fleet-osquery-powershell-empire-and-caldera-setup-environment/>
543 | 
544 | <https://cyberwardog.blogspot.com>
545 | 


--------------------------------------------------------------------------------