Categories: Kali Linux

Mimir : Smart OSINT Collection Of Common IOC Types

Mimir is a smart OSINT collection of common IOC types. This application is designed to assist security analysts and researchers with the collection and assessment of common IOC types. Accepted IOCs currently include IP addresses, domain names, URLs, and file hashes.

The title of this project is named after Mimir, a figure in Norse mythology renowned for his knowledge and wisdom. This application aims to provide you knowledge into IOCs and then some added “wisdom” by calculating risk scores per IOC, assigning a common malware family name to hash lookups based off of reports from VirusTotal and OPSWAT, and leveraging machine learning tools to determine if an IP, URL, or domain is likely to be malicious.

Base Collection

For network based IOCs, Mimir gathers basic information including:

  • Whois
  • ASN
  • Geolocation
  • Reverse DNS
  • Passive DNS

Also Read – Check-LocalAdminHash : PowerShell Tool To Authenticate Multiple Hosts Over WMI Or SMB

Collection Sources

Some of these sources will require an API key, and occassionally only by getting a paid account. I’ve tried to limit reliance on paid services as much as possible.

  • PassiveTotal
  • VirusTotal
  • DomainTools
  • OPSWAT
  • Google SafeBrowsing
  • Shodan
  • PulseDive
  • CSIRTG
  • URLscan
  • HpHosts
  • Blacklist checks
  • Spam blacklist checks

Risk Scoring

The risk scoring works best when Mimir can gather a decent amount of data points for an IOC; pDNS, well populated url/domain results (communicating samples, associated samples, recent scan data, etc.) and also takes into account the ML malicious-ness prediction result.

Machine Learning Predictions

The machine learning prediction results come from the CSIRT Gadgets projects csirtg-domainsml-py, csirtg-ipsml-py, csirtg-urlsml-py.

Output

Mimir offers results output in various options including local file reports or exporting the results to an external service.

  • stdout (console output)
    • normalizes result data, printed with headers and subheaders per module
  • JSON file
    • beautified output to local file
  • Excel
    • uses multiple sheets per IOC type
  • MISP
    • commit new indicators
  • ThreatConnect
    • commit new indicators with confidence and threat ratings (optionally assign tags, a description, and a TLP setting)
R K

Recent Posts

SpyAI : Intelligent Malware With Advanced Capabilities

SpyAI is a sophisticated form of malware that leverages advanced technologies to capture and analyze…

1 day ago

Proxmark3 : The Ultimate Tool For RFID Security And Analysis

The Proxmark3 is a versatile, open-source tool designed for radio-frequency identification (RFID) security analysis, research,…

1 day ago

Awesome Solana Security : Enhancing Program Development

The "Awesome Solana Security" collection is a comprehensive resource designed to help developers build more…

1 day ago

IngressNightmare-POCs : Understanding The Vulnerability Exploitation Flow

The "IngressNightmare" vulnerabilities, disclosed in March 2025, represent a critical set of security issues affecting…

1 day ago

AdaptixC2 : Enhancing Penetration Testing With Advanced Framework Capabilities

AdaptixC2 is an advanced post-exploitation and adversarial emulation framework designed specifically for penetration testers. It…

1 day ago

Bincrypter : Enhancing Linux Binary Security through Runtime Encryption And Obfuscation

Bincrypter is a powerful Linux binary runtime crypter written in BASH. It is designed to…

1 day ago