Essential Tools and Platforms for Cyber Threat Intelligence (CTI)

🧠 Introduction

This guide provides a curated list of the most relevant tools, platforms, and services for Cyber Threat Intelligence (CTI) analysts. The tools are categorized by functionality and provide references and descriptions to help you integrate them into your threat intelligence workflows.

---

🔍 Breach and Credential Leak Intelligence

🔐 Have I Been Pwned (HIBP)

• Checks if email addresses or domains have appeared in known data breaches.
• API available for automated checks and alerting.

🕵️ LeakLooker (when available)

• Search engine for exposed data across paste sites and misconfigured services.
• Useful for identifying leaked credentials and documents.

🔦 Hudson Rock – Cavalier

• Tracks infected devices and stolen credentials via infostealers.
• Offers organizational visibility into compromised employees, assets, and third-party risks.

🌐 Dehashed

• Breach database search engine.
• Supports IPs, emails, usernames, hashes, domains, and more.

🔍 LeakPeak

• Provides visibility into infostealer logs, credentials, and files.
• Enables domain monitoring and IOC enrichment.

---

🕸️ Dark Web Monitoring & Marketplace Intelligence

🌑 DarkOwl Vision

• Real-time and historical darknet data access for threat hunting.
• API and dashboard access to indexed darknet marketplaces and forums.

🕷️ IntSights (now Rapid7 Threat Command)

• Dark web intelligence platform with alerting, brand protection, and fraud detection.
• Integrated with external monitoring and remediation workflows.

🧭 CyberSixgill

• Deep and dark web monitoring with automated alerting and contextual analysis.
• Threat actor profiling, CVE exploitation tracking, and TTP mapping.

---

🧰 General CTI Platforms & Enrichment Services

📚 MISP – Malware Information Sharing Platform

• Open-source threat intelligence sharing platform.
• Supports structured data (IOCs, TTPs) and collaborative sharing between orgs.

🧱 AlienVault OTX

• Free threat intelligence community platform.
• Allows users to submit and consume pulse-based indicators (IPs, domains, hashes).

🔧 VirusTotal

• Aggregates antivirus scan results, network behavior, and metadata for files and URLs.
• Widely used for quick triage and IOC analysis.

🧠 Recorded Future

• Commercial threat intelligence platform with real-time alerting, graph analysis, and risk scoring.
• Covers technical, operational, and strategic CTI.

💡 Shodan

• Search engine for Internet-connected devices.
• Used for infrastructure fingerprinting and exposure assessment.

---

🧪 Malware, Infrastructure & IOC Analysis

🧬 Any.run

• Interactive malware sandbox for dynamic analysis.
• Supports PE, Office files, scripts, and more.

🕸️ MalwareBazaar

• IOC repository focused on malware samples and YARA rules.
• Maintained by abuse.ch.

🌍 ThreatFox

• Aggregated repository of threat intelligence IOCs.
• Strong focus on real-time feeds and community submissions.

---

🧠 Threat Actor & Campaign Intelligence

🧑‍💻 MITRE ATT&CK

• Knowledge base of adversary tactics and techniques.
• Used for mapping threat actor behaviors and detection engineering.

🔬 APT & Threat Group Index – Malpedia

• Profiles of APT groups and malware families.
• Focus on linking tools, actors, and campaigns.

---

✅ Conclusion

This collection represents a solid foundation for building or enriching a CTI workflow across strategic, operational, and tactical levels. Integration and automation with platforms such as MISP, TheHive, or custom dashboards can elevate these tools into a powerful intelligence ecosystem.