CloudIntel - This repo contains IOC, malware and malware analys

项目说明

CloudIntel Attacks Monitoring Project

!Cloud Intel

This repository hosts resources and findings from a project aimed at monitoring attacks on Public Cloud infrastructure, particularly focusing on cloud-native and cloud-only threats.

Features

Real-time data on malicious IP addresses, updated every 24 hours.

(Under de) Malicious file detection API.

Ongoing publication of data on GitHub.

Consuming IOCs from this Repository

This repository is structured to aid in the monitoring of Public Cloud infrastructure attacks, with a focus on cloud-native and cloud-only threats. It includes:

Indicators of Compromise (IOCs)

Malware Analysis

Malware Samples

Usage

To retrieve a comprehensive list of malicious IPs, which is about 30 times larger than the public list on GitHub, use the cloudintel API as follows:

Demo credentials

Feel free to use demo key and Email for testing (This key/Email can change without any notice for andy prod usage please ask for the key)
The Email and key are enclosed between double "quotes"

Demo Email : ""
Demo Key : "key{democloudintel}"

For your API key please Email OR fill this form

Note:

Replace MM-DD-YYYY with the specific date for which you want to fetch IP addresses. For example, to fetch IPs for December 25, 2023, replace MM-DD-YYYY it with 12-25-2023.
Ensure to include your API key and email in the respecti [Your_API_Key] and [Your_Email].

Response format: JSON containing all obser IP addresses.

Case Study/Success Stories

1. My findings are published over :
2. TBD (If you have any new findings then please do share it with us, will link it here)

How to Use this Repository

1. Understanding the Repository Structure: Each folder is named with a date (DD-MM-YYYY) and contains daily collected IOCs.
2. Re Usage Warning: Before using these IOCs, be aware of the risks. Executing code without understanding could be harmful.
3. Accessing Malware Analysis: For insights into the malware samples and their analysis, refer to the corresponding dated folders.
4. Consuming IOCs: Detailed instructions on how to consume these IOCs in your security operations will be provided in the IOC Consumption Guide. This guide will offer step-by-step instructions on how to integrate, automate, and utilize these IOCs with cloud services.
5. Contributing: If you ha or additional IOCs, see the Contribution Guidelines.
6. Getting Support: For questions or support, open an issue or reach out to [me[at]himanshuanand.com](mailto:).

Documentation

For full details, visit our Wiki.

Feature Requests and Contributions

For feature requests or contributions, open an issue.

Media Co

Our project, CloudIntel, has been featured in publications. Here's one of the articles discussing the impact and importance of CloudIntel in cloud security:

Cloud Security with CloudIntel: A User-Friendly Approach to Safeguarding Public Cloud Infrastructure - eForensics Magazine

Acknowledgements

Special thanks to Michel Bamps for his expertise and assistance in integrating Cloudflare Workers with R2, a crucial part of the AWSAttacks infrastructure.

Remember to use the IOCs within the bounds of the MIT License and understand that this is a personal project, not associated with any employer.

For deeper insights into the project's purpose and methodology, refer to the accompanying blog post).

项目信息

开发语言：未知

Star 数：251

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This repo contains IOC, malware and malware analysis associated with Public cloud展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。