mandiant

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.

Automated pipeline to sort and compact Mandiant's NetNTLMv1 Rainbow Tables into "Perfect" .rtc format (0-4096). Optimized for 37% less disk space and 0% chain collisions. P2P Seeded.

Extracts the Timeline of a Redline parsed sqlite database so it can be used e.g. in an ELK stack.

Assemblyline 4 Obfuscated string solver

Parses the Redline CSV output in a csv that is importable by timesketch

PowerShell script for interacting with Mandiant Advantage API to retrieve hash values associated with specified Malware Families. The script provides a menu-driven interface for various malware analysis operations and exports results to Excel.

Fetch Mandiant Threat Intel through APIv4

Verodin — independent third-party profile of a public API surface, by API Evangelist. Verodin was a cybersecurity company that pioneered security instrumentation and validation — its Security Instrumentation Platform (SIP) continuously measured, tested, and improved the effectiveness of an organization's security controls against real attacker beha