ioc-analysis

An explainable multi-source threat intelligence assessment tool for IOC analysis.

Open-source Blue Team SOC platform - threat intel, IOC analysis, phishing simulations & incident management

Hunt IOCs with a tactical terminal - Next.js + FastAPI orchestrating MCP providers, Supabase auth, daily quota and BYOK.

A Python-based Blue Team threat intelligence analyzer for IOC investigation, MITRE ATT&CK mapping, risk scoring, and automated SOC security reporting.

Comprehensive phishing incident response simulation with email forensics, threat intelligence enrichment, and NIST-aligned playbook

SOC / DFIR investigations portfolio with hands-on lab cases covering SIEM alert triage, Phishing Analysis, Malware analysis, Endpoint detection, Network Analysis. Built to demonstrate practical SOC Analyst L1/L2 and DFIR skills.

Hands-on threat hunting and SOC investigations using Microsoft Defender for Endpoint and KQL. Real scenarios covering brute force detection, lateral movement, and IOC analysis mapped to MITRE ATT&CK.

This IOC captures a foundational stage in the cyber kill chain: reconnaissance — where the attacker has not yet breached the system, but is actively probing to discover what might be open, unguarded, or improperly exposed.

An attacker deploys an "evil twin" Wi-Fi access point with the same SSID (network name) as a legitimate network. Devices auto-connect based on familiar SSID memory. The attacker silently captures the WPA2/WPA3 four-way handshake as the client connects.

Defensive cybersecurity dashboard for threat intelligence, IOC analysis, risk scoring, MITRE ATT&CK mapping, vulnerability awareness, alert monitoring, and security awareness training using synthetic data.

Hands-on MISP threat intelligence lab demonstrating phishing IOC analysis, structured object modeling, IOC correlation, validation, and MITRE ATT&CK mapping.

Defensive cybersecurity dashboard combining synthetic threat intelligence, IOC validation, risk scoring, alert correlation, MITRE ATT&CK mapping, vulnerability prioritization, SOC workflow, and security awareness training.

Self-hosted threat intelligence that shows its work: multi-source IOC feeds with corroborated confidence, honest location, CVE monitoring, bulk lookup, STIX/TAXII.

Python cybersecurity project that validates and classifies IP addresses, domains, URLs, and file hashes for IOC analysis.

In this second case study of the structured IOC triage series, we examined a subtle but dangerous host-based compromise involving the abuse of the Windows utility `rundll32.exe` to execute a malicious DLL payload.

End-to-end phishing investigation playbook covering email analysis, KQL hunting, identity compromise assessment, IOC extraction, threat hunting, detection opportunities, and remediation.

Hands-on phishing investigation and report-writing lab covering IOC analysis, URL and domain reputation, threat intelligence, evidence correlation, indicator sanitization, and SOC-style reporting.

Dockerized Cyber Threat Intelligence platform — IOC lookup via VirusTotal + AbuseIPDB | MongoDB persistence | Bootstrap dark dashboard | Flask + Docker Compose

Automated OSINT threat intelligence aggregator with Streamlit dashboard. Queries 6 sources (VirusTotal, AbuseIPDB, Shodan, URLhaus, OTX, RDAP) and produces weighted verdicts for IPs, domains, URLs, and file hashes.

SOC IntelHub — IOC Triage Dashboard (VirusTotal + AbuseIPDB + OTX + MITRE Mapping) A portfolio project for SOC analysis, threat enrichment & automated ATT&CK mapping.