mandiant

Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.

Automated pipeline to sort and compact Mandiant's NetNTLMv1 Rainbow Tables into "Perfect" .rtc format (0-4096). Optimized for 37% less disk space and 0% chain collisions. P2P Seeded.

Extracts the Timeline of a Redline parsed sqlite database so it can be used e.g. in an ELK stack.

Assemblyline 4 Obfuscated string solver

MCP server exposing capa (Mandiant) for capability detection with MITRE ATT&CK / MBC mappings.

PowerShell script for interacting with Mandiant Advantage API to retrieve hash values associated with specified Malware Families. The script provides a menu-driven interface for various malware analysis operations and exports results to Excel.

Parses the Redline CSV output in a csv that is importable by timesketch

Fetch Mandiant Threat Intel through APIv4

Verodin was a cybersecurity company that pioneered security instrumentation and validation — its Security Instrumentation Platform (SIP) continuously measured, tested, and improved the effectiveness of an organization's security controls against real attacker behavior (a category later known as breach and attack simulation).