Threat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and hunting designed for intel and malware analysts as well as threat hunters to get up and running quickly.

Extracts the Timeline of a Redline parsed sqlite database so it can be used e.g. in an ELK stack.

Assemblyline 4 Obfuscated string solver

Automated pipeline to sort and compact Mandiant's NetNTLMv1 Rainbow Tables into "Perfect" .rtc format (0-4096). Optimized for 37% less disk space and 0% chain collisions. P2P Seeded.

Parses the Redline CSV output in a csv that is importable by timesketch

PowerShell script for interacting with Mandiant Advantage API to retrieve hash values associated with specified Malware Families. The script provides a menu-driven interface for various malware analysis operations and exports results to Excel.

Fetch Mandiant Threat Intel through APIv4