Awesome-Security-Analyst
This is a curated list of awesome security tools used by analyst on the daily basis for Blue Teaming.
MALWARE
Malware aka Malicious Software is a file or code,usually delivered over a N/W that infects, explores, steals or conducts malicious activity. It is a collective term for viruses, trojans and other destructive computer programs used by ATP(Advanced Persistent Threat Actor)
Tool
Description
Official Link
Virus Total
Virus Total is a free service founded in 2004 that analyses files and URLs for viruses, worms, trojans and other kind of malicious content. VirusTotal inspects items with over 70 antivirus scanners and URL/domain blocklisting services, in addition to a myriad of tools to extract signals from the studied content. Any user can select a file from their computer using their browser and send it to VirusTotal. VirusTotal offers a number of file submission methods, including the primary public web interface, desktop uploaders, browser extensions and a programmatic API. The web interface has the highest scanning priority among the publicly available submission methods. Submissions may be scripted in any programming language using the HTTP-based public API.
Hybrid Analysis
Hybrid Analysis . com is a free web based page that can be used for malware analysis service for the community, in-depth static and dynamic analysis
Alien Vault- Open Threat Exchange
The Alien Labs® Open Threat Exchange® (OTX™) is the world’s first and largest truly open threat intelligence community. OTX provides access to a global community of threat researchers and security professionals, with more than 100,000 participants in 140 countries, who contribute over 19 million threat indicators daily. OTX allows anyone in the security community to actively discuss, research, validate, and share the latest threat data, trends, and techniques, thereby helping one another strengthen cyber defenses and raise awareness of emerging threats on a global level.
Joe Sandbox
Joe Security, founded in 2011 by Stefan Bühlmann is a Swiss-based, privately owned software development company. Joe Security is the developer of Joe Sandbox, industry's deepest malware analysis system. Joe Sandbox is actively used by leading CERTs, CIRTS, SOCs, malware analysts and incident responders around the world to defend malware. Joe Security is one of the first movers in the field of dynamic malware analysis and has invented several unique analysis technologies, including hybrid code analysis and hypervisor based inspection.
ANY.RUN
Interactive online malware analysis service for dynamic and static research of most types of threats using any environments. Replaces a set of tools for research. The service can be used for a convenient in-depth analysis of new (unidentified) malicious objects, as well as for the investigation of cyber incidentals.
THREAT INTELLIGENCE
Tool
Description
Official Link
Microsoft Defender Threat Intelligence
Microsoft Defender Threat Intelligence (Defender TI) is a platform that streamlines triage, incident response, threat hunting, vulnerability management, and cyber threat intelligence analyst workflows when conducting threat infrastructure analysis and gathering threat intelligence.
Virus Total
Virus Total is a free service founded in 2004 that analyses files and URLs for viruses, worms, trojans and other kind of malicious content. VirusTotal inspects items with over 70 antivirus scanners and URL/domain blocklisting services, in addition to a myriad of tools to extract signals from the studied content. Any user can select a file from their computer using their browser and send it to VirusTotal. VirusTotal offers a number of file submission methods, including the primary public web interface, desktop uploaders, browser extensions and a programmatic API. The web interface has the highest scanning priority among the publicly available submission methods. Submissions may be scripted in any programming language using the HTTP-based public API.
Alien Vault- Open Threat Exchange
The Alien Labs® Open Threat Exchange® (OTX™) is the world’s first and largest truly open threat intelligence community. OTX provides access to a global community of threat researchers and security professionals, with more than 100,000 participants in 140 countries, who contribute over 19 million threat indicators daily. OTX allows anyone in the security community to actively discuss, research, validate, and share the latest threat data, trends, and techniques, thereby helping one another strengthen cyber defenses and raise awareness of emerging threats on a global level.
Threat Miner
ThreatMiner is a threat intelligence portal designed to enable analysts to research under a single interface. It is used in the SANS FOR578 Cyber Threat Intelligence course . API integration is available for many industry leading platforms including: Malware Information Sharing Platform (MISP) Splunk Demisto Rapid7 InsightConnect IBM Resilient
IBM X-Force Exchange
IBM® X-Force Exchange is a cloud-based, threat intelligence sharing platform that you can use to rapidly research the latest global security threats, aggregate actionable intelligence, consult with experts and collaborate with peers. IBM X-Force Exchange, supported by human- and machine-generated intelligence, leverages the scale of IBM X-Force to help users stay ahead of emerging threats
PulseDive
Pulsedive is a bootstrapped cybersecurity company focused on high-fidelity, high-value threat intelligence solutions to help organizations proactively improve their security posture. Pulsedive ingests millions of IPs, domains, and URLs collected from dozens of feeds and user submissions worldwide. With our user community actively submitting new IOCs every day, Pulsedive has data that no one else has
IP/WEB REPUTATION
Tool
Description
Official Link
Cisco Talos Intelligence Group
Cisco Talos Intelligence Group is one of the largest commercial threat intelligence teams in the world, comprised of world-class researchers, analysts and engineers.Talos maintains the official rule sets of Snort.org, ClamAV and SpamCop
Virus Total
Virus Total is a free service founded in 2004 that analyses files and URLs for viruses, worms, trojans and other kind of malicious content. VirusTotal inspects items with over 70 antivirus scanners and URL/domain blocklisting services, in addition to a myriad of tools to extract signals from the studied content. Any user can select a file from their computer using their browser and send it to VirusTotal. VirusTotal offers a number of file submission methods, including the primary public web interface, desktop uploaders, browser extensions and a programmatic API. The web interface has the highest scanning priority among the publicly available submission methods. Submissions may be scripted in any programming language using the HTTP-based public API.
AbiuseIPDB
AbuseIPDB is a project managed by Marathon Studios Inc. AbuseIPDB is a project dedicated to helping systems administrators and webmasters check and report IP addresses that are involved in malicious activity such as spamming, hack attempts, DDoS attacks, etc.
Grey Noise
GreyNoise is a cybersecurity platform that collects and analyzes Internet-wide scan and attack traffic. This data is made available through the web-based Visualizer and GreyNoise APIs so users can contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats.
IBM X-Force Exchange
IBM® X-Force Exchange is a cloud-based, threat intelligence sharing platform that you can use to rapidly research the latest global security threats, aggregate actionable intelligence, consult with experts and collaborate with peers. IBM X-Force Exchange, supported by human- and machine-generated intelligence, leverages the scale of IBM X-Force to help users stay ahead of emerging threats
Bright Cloud by Open Text
BrightCloud was the first threat intelligence platform to harness the cloud and artificial intelligence to stop zero-day threats in real time. The platform is used to secure businesses and their products worldwide with threat intelligence and protection for endpoints and networks
WEB ANALYSIS
Tool
Description
Official Link
Urlscan
urlscan.io is a free service to scan and analyse websites. When a URL is submitted to urlscan.io, an automated process will browse to the URL like a regular user and record the activity that this page navigation creates. This includes the domains and IPs contacted, the resources (JavaScript, CSS, etc) requested from those domains, as well as additional information about the page itself. urlscan.io will take a screenshot of the page, record the DOM content, JavaScript global variables, cookies created by the page, and a myriad of other observations. If the site is targeting the users one of the more than 900 brands tracked by urlscan.io, it will be highlighted as potentially malicious in the scan results.
Browserling
Browserling solves cross-browser testing problem including SSH tunnels for local testing, Responsive testing, Screenshots, Access to latest browsers,Headless API
Kasm Workspace
Streaming containerized apps and desktops to end-users. The Workspaces platform provides enterprise-class orchestration, data loss prevention, and web streaming technology to enable the delivery of containerized workloads to your browser.
SANDBOX
Tool
Description
Official Link
ANY.RUN
Interactive online malware analysis service for dynamic and static research of most types of threats using any environments. Replaces a set of tools for research. The service can be used for a convenient in-depth analysis of new (unidentified) malicious objects, as well as for the investigation of cyber incidentals.
Browserling
Browserling solves cross-browser testing problem including SSH tunnels for local testing, Responsive testing, Screenshots, Access to latest browsers,Headless API
Hybrid Analysis
Hybrid Analysis . com is a free web based page that can be used for malware analysis service for the community, in-depth static and dynamic analysis
CAPE SandBox
CAPE is an open source automated malware analysis system. It can be used to automatically run and analyse files and collect comprehensive analysis results that outline what the malware does while running inside an isolated windows operating system.
Joe Sandbox
Joe Security, founded in 2011 by Stefan Bühlmann is a Swiss-based, privately owned software development company. Joe Security is the developer of Joe Sandbox, industry’s deepest malware analysis system. Joe Sandbox is actively used by leading CERTs, CIRTS, SOCs, malware analysts and incident responders around the world to defend malware. Joe Security is one of the first movers in the field of dynamic malware analysis and has invented several unique analysis technologies, including hybrid code analysis and hypervisor based inspection.
USEFUL LINKS
RESOURCES
Official Link
The DFIR Report - Real Intrusions by Real Attackers, The Truth Behind the Intrusion
The Blue Team Notes | Dray Agha
Blog by Andrea Fortuna
Weekly Roundup of Digital Forensics and Incident Response News
TCP/IP cheatsheet
WTFBins
Cyber Chef
GTFOBins : List of Unix Binaries
Blackhills Infosec Blog
Hugs4bugs
Last updated