wolf-tools

KO | EN

gitlite — search

#python #typescript #golang #machine-learning #rust #deep-learning #docker #macos #java #windows #cli #kubernetes #openai #open-source

(★ 80)

Tools and scripts by Arctic Wolf

File Explorer

Download Latest Version (.zip)

- - log4shell_deep_scan_0.3.zip
- - .gitignore
  - README.md
- LICENSE.txt
- log4shell_deep_scan.ps1
- log4shell_deep_scan.sh
- README.md
- - spring4shell_deep_scan_0.3.zip
- .gitignore
- LICENSE.txt
- README.md
- spring4shell_deep_scan.ps1
- spring4shell_deep_scan.sh
- - .gitkeep
  - fifa-2026-campaign-metadata.csv
  - fifa-2026-ioc-behavioral.csv
  - fifa-2026-ioc-files.csv
  - fifa-2026-ioc-network.csv
  - fifa-2026-pdf-metadata.csv
  - fifa-2026-ttps.csv
- - anubis-tradecraft-file-iocs.csv
  - anubis-tradecraft-network-iocs.csv
  - anubis-tradecraft-ransomware-encryptor-artifacts.csv
  - anubis-tradecraft-rmm.csv
  - anubis-tradecraft-ttp-mapping.csv
- - Bluenoroff_Appendix_items.md
- - cookie-crumbles-qilin-host-system.csv
  - cookie-crumbles-qilin-network.csv
  - cookie-crumbles-qilin-tools.csv
  - cookie-crumbles-qilin-ttps.csv
- - cve-2023-22527-yara.yar
  - LICENSE.txt
  - README.md
- - castleloader-certificates.csv
  - castleloader-domains.csv
  - castleloader-files.csv
  - castleloader-ips.csv
  - castleloader-ttps.csv
- - boryptgrab_indicators.csv
  - BoryptGrab_infostealer.yara
- - globalprotect-cve-2026-0257-campaign-metadata.csv
  - globalprotect-cve-2026-0257-cves.csv
  - globalprotect-cve-2026-0257-ioc-network.csv
  - globalprotect-cve-2026-0257-ioc-system-artifacts.csv
  - globalprotect-cve-2026-0257-ttps.csv
- - kali365-cluster-metadata.csv
  - kali365-ioc-exfiltration.csv
  - kali365-ioc-network.csv
  - kali365-ttps.csv
- - LICENSE.txt
  - lorenz-indicators.csv
  - lorenz-suricata.rules
  - lorenz-yara.yar
  - README.md
- - LICENSE.txt
  - lorenz-indicators-getting-dumped.csv
  - lorenz-sigma-win_driver_load_tool_magnet.yml
  - lorenz-sigma-win_proc_exec_magnet.yml
  - lorenz-yara-magnet-ram-capture.yar
  - magnet-ram-capture-driver-artifacts.csv
  - README.md
- - strange-tides-application-identifiers.csv
  - strange-tides-behavioral-iocs.csv
  - strange-tides-common-error-code.json
  - strange-tides-dns-activity-phishing.csv
  - strange-tides-domains.csv
  - strange-tides-graph-api-recon-query.txt
  - strange-tides-initial-malicious-sign-in-events.csv
  - strange-tides-ip-addresses.csv
  - strange-tides-malicious-mailitemsaccessed-event.json
  - strange-tides-network.csv
  - strange-tides-periodic-token-refresh-activity-firefox.csv
  - strange-tides-periodic-token-refresh-activity-python-requests.csv
- - ekz-cves.csv
  - ekz-infostealer-metadata.csv
  - ekz-infostealer.yar
  - ekz-ioc-files.csv
  - ekz-ioc-log-strings.csv
  - ekz-ioc-malicious-powershell-samples-defanged.txt
  - ekz-ioc-network.csv
  - ekz-ioc-system-artifacts.csv
  - ekz-ttps.csv
- - AW_WDAC_Iran_Policy.cip
  - AW_WDAC_Iran_Policy.xml
  - LICENSE.txt
  - README.md
- lorenz-sigma-win_magnet_service_install.yml
.gitignore
CODEOWNERS
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# wolf-tools

Open source tools and scripts by Arctic Wolf:

## Vulnerability Scanners

- [Arctic Wolf Log4Shell Deep Scan](log4shell/README.md): detects Java application packages
subject to [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) and 
[CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046)
- [Arctic Wolf Spring4Shell Deep Scan](spring4shell/README.md): detects Java application packages
subject to [CVE-2022-22965](https://tanzu.vmware.com/security/cve-2022-22965)

## Threat Intelligence

Detection rules, IOCs, and artifacts published by Arctic Wolf Labs.

- [CVE-2023-22527 Leading to C3RB3R Ransomware](threat-intelligence/cve-2023-22527-leading-to-c3rb3r/README.md): YARA rules to detect activity seen during exploitation of Confluence Server via CVE-2023-22527
- [Lorenz Ransomware: Chiseling In](threat-intelligence/lorenz-ransomware-chiseling-in/README.md): YARA rules, Suricata rules, and IOCs associated with the Lorenz ransomware group
- [Lorenz Ransomware: Getting Dumped](threat-intelligence/lorenz-ransomware-getting-dumped/README.md): IOCs, artifacts, Sigma rules, and YARA rules related to unexpected use of Magnet RAM Capture by Lorenz ransomware actors
- [WDAC Policy for Iranian App Abuse (2025)](threat-intelligence/wdac-blocking-iranian-app-abuse-2025/README.md): Windows Defender Application Control policy to block dual-use application abuse by Iranian threat groups

wolf-tools

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

wolf-tools

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README