w00dbury / iok Goto Github PK

View detections on phish.report 🐟

Indicator of Kit is an open source detection language for phishing site techniques, kits, and threat actors 🕵️

• Simple: based on Sigma, a simple detection rules language 🚀
• Rich metadata: rules have descriptions, tags, and links to blog posts or related rules.

Use cases:

• Identify fingerprints of known threat actors
• Discover anti-analysis techniques
• Classify which specific phishing kit is in use on a page
• Identify deceptive websites dropping malicious software
• Discover APT infrastructure
• Detect malware C&C panels

IOK indicators are written using Sigma

We are always looking for contributions: there's far more phishing kits and techniques than a single team can analyse!

To contribute a new rule:

1. Try to make sure it doesn't already exist
2. Open a pull request, adding your new file in the indicators/ folder
3. We'll review it and merge your PR
4. It'll go live on phish.report/IOK!

There's a reference on how to write IOK rules in the Phish Report documentation.

This project is ODbL licensed. You're free to use the rules in your own projects (including commercial ones!) as long as you credit phish.report/IOK as the source.

For more details, read OpenStreetMap's guidance (who also use the ODbL license).