BRANDEFENSE/IoC

Indicators of compromise (IOCs) and YARA rules from Brandefense threat research

Indicators of compromise (IP addresses, domains, URLs, file hashes) and YARA and Sigma rules from Brandefense threat research on APT groups, ransomware, infostealers and phishing campaigns. Use them for threat hunting, detection and blocklists.

Each row links to the files and, where one exists, the original analysis and the maintained threat actor profile.

| Threat | Files | Analysis | Profile | |---|---|---|---| | APT18 (Dynamite Panda) | APT18 IoCs.txt | analysis | profile | | APT28 (Fancy Bear) | APT28 IoC's.txt | analysis | profile | | APT32 (OceanLotus) | ocean lotus apt group IoCs.txt | analysis | profile | | APT33 | apt33 IoCs.txt | analysis | profile | | APT34 (OilRig): SideTwist backdoor | APT34 New Backdoor-SideTwist Variant IoCs | analysis | profile | | APT36 (Transparent Tribe, Mythic Leopard) | IoC-YARA-rules-apt36.txt | analysis | profile | | APT36: Poseidon malware | Poseidon Malware IoCs | analysis | profile | | APT38 (Lazarus Group) | IoC-YARA-SIGMA-Rules- APT38.txt | | profile | | Sandworm (APT44) | SandWorm IoCs and Yara Rules.txt | analysis | profile | | El Machete (APT-C-43) | El Machete APT Group IoC's.txt | analysis | | | FIN8: Sardonic backdoor | Sardonic Malware IoC | analysis | | | AiTM phishing campaign | AiTM Phishing Campaign IoC's.txt | analysis | | | LockBit 3.0 ransomware | LockBit 3.0 IoC and YARA Rules.txt | analysis | profile | | Cylance ransomware | Cylance Ransomware | analysis | | | Snatch ransomware | Snatch Ransomware | analysis | | | STOP/Djvu ransomware | Stop-Djvu Ransomware IoCs & YARA Rules | analysis | | | Quantum ransomware | Quantum Ransomware IoCs | | | | KageNoHitobito ransomware | KageNoHitobito Ransomware Technical Analysis | | | | RedLine Stealer | redline-IoC.txt · redline-yaraRule.txt | | profile | | Stealc | Stealc Malware YARA Rule | analysis | | | Mystic Stealer | Mystic stealer | analysis | | | Phemedrone Stealer | Phemedrone Stealer | analysis | | | Gotham Stealer | Gotham Stealer IoCs & YARA Rule | analysis | | | Invicta Stealer | Invicta Stealer IoCs and Yara Rule | analysis | | | Echida Stealer | echida stealer YARA Rule | analysis | | | PrivateLoader and RisePro Stealer | PrivateLoader & RiseProStealer | analysis | | | Godfather Android banking trojan | Godfather Android Trojan IoCs | analysis | | | SUBMARINE backdoor | SUBMARINE Backdoor IoCs | analysis | | | Zebrocy | zebrocy-ioc-yara-rules.txt | analysis | | | KmsdBot | kmsdbot-IoC.txt | analysis | |

These indicators were published with the analyses above and are not updated; check their age before blocking. For maintained, sourced profiles of APT groups, ransomware groups, malware and exploited vulnerabilities, see the Threat Actor Dataset and the Exploited Vulnerabilities Dataset.

About Brandefense

Brandefense is an AI-driven threat intelligence platform that unifies Cyber Threat Intelligence, Digital Risk Protection and External Attack Surface Management. The same profiles, with timelines, defences and FAQ, are on the Brandefense Knowledge Hub. Free tools: ATLAS.

Star history