> For the complete documentation index, see [llms.txt](https://breachtrace.gitbook.io/vulnkeeper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breachtrace.gitbook.io/vulnkeeper/chapter-f/17-17-threat-intelligence-malware-ransomware-and-in-the-wild-exploitation-context.md). # 17. Threat intelligence, malware, ransomware & in-the-wild exploitation context ## 17.1 Major threat research sources

Sl. #	Source Title	Notes
1	Mandiant / Google Cloud Threat Intelligence `Link(s)`: cloud.google.com/blog/topics/threat-intelligence `Access / Cost`: Free public blog; commercial threat intel products separate	`Relevance`: Threat intelligence & exploitation-in-the-wild context. `Notes & POIs`: Useful for campaign-level vulnerability exploitation context.
2	Microsoft Threat Intelligence blog `Link(s)`: www.microsoft.com/en-us/security/blog/topic/threat-intelligence `Access / Cost`: Free public blog	`Relevance`: Microsoft threat intel & exploitation reports. `Notes & POIs`: Useful for attacker behavior, exploitation campaigns, & mitigations.
3	Google Threat Analysis Group `Link(s)`: blog.google/threat-analysis-group `Access / Cost`: Free public blog	`Relevance`: Nation-state & high-end threat research. `Notes & POIs`: Useful for exploited-in-the-wild context.
4	Palo Alto Unit 42 `Link(s)`: unit42.paloaltonetworks.com `Access / Cost`: Free public blog; commercial threat intel services separate	`Relevance`: Threat research & vulnerability exploitation reporting. `Notes & POIs`: Useful for campaign & malware context.
5	Cisco Talos `Link(s)`: blog.talosintelligence.com `Access / Cost`: Free public blog; commercial Cisco products separate	`Relevance`: Threat intel, malware, & vulnerability research. `Notes & POIs`: Useful for IOCs & exploit campaigns.
6	Rapid7 vulnerability management blog `Link(s)`: www.rapid7.com/blog/tag/vulnerability-management `Access / Cost`: Free public blog; commercial products separate	`Relevance`: Vulnerability management & exploitability commentary. `Notes & POIs`: Useful for operational triage context.
7	Sophos X-Ops `Link(s)`: news.sophos.com/en-us/category/threat-research `Access / Cost`: Free public blog; commercial products separate	`Relevance`: Threat research & incident reports. `Notes & POIs`: Useful for exploitation context & malware behavior.
8	CrowdStrike Blog `Link(s)`: www.crowdstrike.com/en-us/blog `Access / Cost`: Free public blog; commercial products separate	`Relevance`: Threat intelligence & incident research. `Notes & POIs`: Useful for adversary behavior & vulnerability exploitation context.
9	SentinelOne Labs `Link(s)`: www.sentinelone.com/labs `Access / Cost`: Free public blog; commercial products separate	`Relevance`: Malware & threat research. `Notes & POIs`: Useful for exploit chains & malware analysis.
10	Kaspersky Securelist `Link(s)`: securelist.com `Access / Cost`: Free public blog; commercial products separate	`Relevance`: Threat research & malware analysis. `Notes & POIs`: Useful for campaign-level context.
11	ESET WeLiveSecurity `Link(s)`: www.welivesecurity.com `Access / Cost`: Free public blog; commercial products separate	`Relevance`: Threat research & malware analysis. `Notes & POIs`: Useful for exploitation narratives & IOCs.
12	Trend Micro Research `Link(s)`: www.trendmicro.com/en_us/research.html `Access / Cost`: Free public research; commercial products separate	`Relevance`: Threat & vulnerability research. `Notes & POIs`: Useful for active exploitation context.
13	FortiGuard Labs `Link(s)`: www.fortiguard.com/research `Access / Cost`: Free public research; commercial products separate	`Relevance`: Fortinet threat research. `Notes & POIs`: Useful for attack patterns & indicators.
14	Check Point Research `Link(s)`: research.checkpoint.com `Access / Cost`: Free public blog; commercial products separate	`Relevance`: Threat research & vulnerability analysis. `Notes & POIs`: Useful for campaign & exploit analysis.
15	Elastic Security Labs `Link(s)`: www.elastic.co/security-labs `Access / Cost`: Free public research; commercial products separate	`Relevance`: Detection engineering & threat research. `Notes & POIs`: Useful for detection logic & adversary behavior.
16	Sekoia Threat Intelligence `Link(s)`: blog.sekoia.io `Access / Cost`: Free public blog; commercial threat intel separate	`Relevance`: Threat intelligence research. `Notes & POIs`: Useful for IOCs & campaign context.

## 17.2 Malware & IOC repositories

Sl. #	Source Title	Notes
1	MISP `Link(s)`: www.misp-project.org `Access / Cost`: Free / open-source; data sharing depends on communities/instances	`Relevance`: Threat intelligence sharing platform. `Notes & POIs`: Useful for IOC correlation & sharing.
2	AlienVault OTX `Link(s)`: otx.alienvault.com `Access / Cost`: Free community access; commercial AT&T Cybersecurity products separate	`Relevance`: Open threat exchange for IOCs. `Notes & POIs`: Quality varies by pulse/source. Validate before enforcement.
3	AbuseIPDB `Link(s)`: www.abuseipdb.com `Access / Cost`: Free tier / paid plans	`Relevance`: IP abuse reputation database. `Notes & POIs`: Useful for IP enrichment; not vulnerability-specific.
4	URLhaus `Link(s)`: urlhaus.abuse.ch `Access / Cost`: Free public	`Relevance`: Malware URL tracking. `Notes & POIs`: Useful for IOC enrichment.
5	MalwareBazaar `Link(s)`: bazaar.abuse.ch `Access / Cost`: Free public	`Relevance`: Malware sample sharing. `Notes & POIs`: Useful for malware family & hash enrichment.
6	ThreatFox `Link(s)`: threatfox.abuse.ch `Access / Cost`: Free public	`Relevance`: Threat intelligence indicators. `Notes & POIs`: Useful for IOCs.
7	Feodo Tracker `Link(s)`: feodotracker.abuse.ch `Access / Cost`: Free public	`Relevance`: Botnet C2 tracking. `Notes & POIs`: Useful for malware infrastructure context.
8	PhishTank `Link(s)`: phishtank.org `Access / Cost`: Free community access; API/account may be required	`Relevance`: Phishing URL database. `Notes & POIs`: Useful for phishing exposure & IOC enrichment.
9	OpenPhish `Link(s)`: openphish.com `Access / Cost`: Free limited feed / paid premium feeds	`Relevance`: Phishing intelligence. `Notes & POIs`: Commercial/community source; check terms.
10	YARA `Link(s)`: github.com/VirusTotal/yara `Access / Cost`: Free / open-source public GitHub repo	`Relevance`: Malware classification & pattern matching engine. `Notes & POIs`: Useful for detection signatures.
11	YARA-Rules `Link(s)`: github.com/Yara-Rules/rules `Access / Cost`: Free / open-source public GitHub repo	`Relevance`: Community YARA rules. `Notes & POIs`: Validate rule quality before production use.
12	SigmaHQ `Link(s)`: github.com/SigmaHQ/sigma `Access / Cost`: Free / open-source public GitHub repo	`Relevance`: Generic SIEM detection rule format. `Notes & POIs`: Useful for detection engineering.
13	LOLBAS `Link(s)`: lolbas-project.github.io `Access / Cost`: Free public / open-source project	`Relevance`: Living-off-the-land binaries/scripts catalog. `Notes & POIs`: Useful for attack behavior detection.
14	GTFOBins `Link(s)`: gtfobins.github.io `Access / Cost`: Free public / open-source project	`Relevance`: Unix binary abuse catalog. `Notes & POIs`: Useful for privilege escalation & post-exploitation detection.
15	Ransomware.live `Link(s)`: www.ransomware.live `Access / Cost`: Free public	`Relevance`: Ransomware group/leak-site tracking. `Notes & POIs`: Useful for ransomware exploitation context & trend analysis.

## Discussion This chapter section keeps the latest table structure, source titles, access/cost fields, relevance notes, & operational notes from the source inventory. Review the table entries as ingestion candidates, then validate source freshness, licensing, authentication requirements, & link-check behavior before production use. *** #### [Back to Index](/vulnkeeper/index.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://breachtrace.gitbook.io/vulnkeeper/chapter-f/17-17-threat-intelligence-malware-ransomware-and-in-the-wild-exploitation-context.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.