greyware_tool_keyword_network_detection.csv

"keyword","metadata_keyword_regex","metadata_keyword_type","metadata_tool","metadata_description","metadata_tool_techniques","metadata_tool_tactics","metadata_malwares_name","metadata_groups_name","metadata_category","metadata_link","metadata_enable_endpoint_detection","metadata_enable_proxy_detection","metadata_tags","metadata_comment","metadata_severity_score","metadata_popularity_score","metadata_github_stars","metadata_github_forks","metadata_github_updated_at","metadata_github_created_at"
"*&browser=tor&api=false*",".{0,1000}\&browser\=tor\&api\=false.{0,1000}","greyware_tool_keyword","browser.lol","Virtual Browser - Safely visit blocked or risky websites - can be used to bypass network restrictions within a corporate environment","T1071 - T1090 - T1562","TA0005","N/A","N/A","Defense Evasion","https://browser.lol","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*./nmap*",".{0,1000}\.\/nmap.{0,1000}","greyware_tool_keyword","nmap","A very common tool. Network host vuln and port detector.","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Discovery","https://github.com/nmap/nmap","1","1","#linux","greyware tool - risks of False positive !","8","10","10695","2466","2025-02-27T16:45:09Z","2012-03-09T14:47:43Z"
"*._tcp.argotunnel.com*",".{0,1000}\._tcp\.argotunnel\.com.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","N/A","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*.a.pinggy.online*",".{0,1000}\.a\.pinggy\.online.{0,1000}","greyware_tool_keyword","pinggy","Create HTTP/TCP or TLS tunnels to your Mac/PC. Even if it is sitting behind firewalls and NATs.","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://pinggy.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.api.mega.co.nz*",".{0,1000}\.api\.mega\.co\.nz.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","#filehostingservice #P2P","N/A","10","10","N/A","N/A","N/A","N/A"
"*.api.splashtop.com*",".{0,1000}\.api\.splashtop\.com.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.apitest.barracudamsp.com*",".{0,1000}\.apitest\.barracudamsp\.com.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.asse.devtunnels.ms*",".{0,1000}\.asse\.devtunnels\.ms.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*.aweray.net*",".{0,1000}\.aweray\.net.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.beyondtrustcloud.com/session_complete*",".{0,1000}\.beyondtrustcloud\.com\/session_complete.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.comodo.com/static/frontend/static-pages/enroll-wizard/token*",".{0,1000}\.comodo\.com\/static\/frontend\/static\-pages\/enroll\-wizard\/token.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.console.gotoassist.com*",".{0,1000}\.console\.gotoassist\.com.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.d.requestbin.net*",".{0,1000}\.d\.requestbin\.net.{0,1000}","greyware_tool_keyword","requestbin.net","allows users to create a unique URL to collect and inspect HTTP requests. It is commonly used for debugging webhooks - it can also be abused by attackers for verifying the reachability and effectiveness of their payloads","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","http://requestbin.net","1","1","N/A","Out of band interaction domains","10","10","N/A","N/A","N/A","N/A"
"*.dev1.fleetdeck.io*",".{0,1000}\.dev1\.fleetdeck\.io.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*.dnslog.cn:*",".{0,1000}\.dnslog\.cn\:.{0,1000}","greyware_tool_keyword","dnslog.cn","allows users to create a unique URL to collect and inspect HTTP requests. It is commonly used for debugging webhooks - it can also be abused by attackers for verifying the reachability and effectiveness of their payloads","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","http://dnslog.cn","1","1","N/A","Out of band interaction domains","10","10","N/A","N/A","N/A","N/A"
"*.exec*.interact.sh*",".{0,1000}\.exec.{0,1000}\.interact\.sh.{0,1000}","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C4","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*.free.pinggy.online*",".{0,1000}\.free\.pinggy\.online.{0,1000}","greyware_tool_keyword","pinggy","Create HTTP/TCP or TLS tunnels to your Mac/PC. Even if it is sitting behind firewalls and NATs.","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://pinggy.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.gofile.io/uploadFile*",".{0,1000}\.gofile\.io\/uploadFile.{0,1000}","greyware_tool_keyword","gofile.io","legitimate service abused by lots of stealer to exfiltrate data","T1567.002","TA0010","N/A","Hive - Royal - LockBit - Vice Society - BlackSuit - Conti","Data Exfiltration","https://gofile.io","1","1","#filehostingservice","N/A","8","10","N/A","N/A","N/A","N/A"
"*.in.zrok.io*",".{0,1000}\.in\.zrok\.io.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*.l.tunwg.com*",".{0,1000}\.l\.tunwg\.com.{0,1000}","greyware_tool_keyword","tunwg","End to end encrypted secure tunnel to local servers","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ntnj/tunwg","1","1","N/A","N/A","10","10","233","9","2024-09-18T15:03:45Z","2023-01-16T17:51:13Z"
"*.localltunnel.me*",".{0,1000}\.localltunnel\.me.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/localtunnel/localtunnel","1","1","N/A","N/A","10","10","20234","1399","2024-03-20T17:04:54Z","2012-06-18T02:33:30Z"
"*.loclx.io:*",".{0,1000}\.loclx\.io\:.{0,1000}","greyware_tool_keyword","localxpose","LocalXpose is a reverse proxy that enables you to expose your localhost to the internet","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://localxpose.io/","1","1","N/A","N/A","10","1","N/A","N/A","N/A","N/A"
"*.mspa.n-able.com*",".{0,1000}\.mspa\.n\-able\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.myftp.biz*",".{0,1000}\.myftp\.biz.{0,1000}","greyware_tool_keyword","myftp.biz","dyndns - lots of subdomains associated with malwares - could be used in various ways for both legitimate and malicious activities (malicious mostly)","T1071 - T1021 - T1095 - T1059","TA0010 - TA0008 - TA0009 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/hagezi/dns-blocklists/blob/9d6562bddc175b59241d5935531f648cd6b6d9c8/rpz/dyndns.txt#L103","1","1","#filehostingservice #P2P","N/A","10","10","9217","299","2025-03-02T04:21:00Z","2022-04-25T07:13:09Z"
"*.myftp.org*",".{0,1000}\.myftp\.org.{0,1000}","greyware_tool_keyword","myftp.org","dyndns - lots of subdomains associated with malwares - myftp.org could be used in various ways for both legitimate and malicious activities (malicious mostly)","T1071 - T1021 - T1095 - T1059","TA0010 - TA0008 - TA0009 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/pan-unit42/iocs/blob/master/rat_nest/iocs.csv","1","1","#filehostingservice #P2P","N/A","10","8","707","152","2025-01-30T22:03:27Z","2015-06-04T13:37:09Z"
"*.ngrok.me*",".{0,1000}\.ngrok\.me.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","N/A","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*.realtime.services.box.net*",".{0,1000}\.realtime\.services\.box\.net.{0,1000}","greyware_tool_keyword","Box","Attackers have used box to store malicious files and then share them with targets - box can also be used for data exfiltration by attackers","T1567.002 - T1071.001 - T1036 - T1048.002","TA0005 - TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://app.box.com/","1","1","#dnsquery","N/A","6","7","N/A","N/A","N/A","N/A"
"*.rel.tunnels.api.visualstudio.com*",".{0,1000}\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","vscode","built-in port forwarding. This feature allows you to share locally running services over the internet to other people and devices.","T1090 - T1003 - T1571","TA0010 - TA0002 - TA0009","N/A","N/A","C2","https://twitter.com/code/status/1699869087071899669","0","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.relay.splashtop.com*",".{0,1000}\.relay\.splashtop\.com.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.remotepc.com*",".{0,1000}\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.remotepc.com*",".{0,1000}\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","network","10","10","N/A","N/A","N/A","N/A"
"*.remoteutilities.com*",".{0,1000}\.remoteutilities\.com.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.remoteview.logmein.com*",".{0,1000}\.remoteview\.logmein\.com.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.router.teamviewer.com*",".{0,1000}\.router\.teamviewer\.com.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*.servicedesk.atera.com/GetAgent*",".{0,1000}\.servicedesk\.atera\.com\/GetAgent.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.share.zrok.io*",".{0,1000}\.share\.zrok\.io.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*.srv.browser.lol*",".{0,1000}\.srv\.browser\.lol.{0,1000}","greyware_tool_keyword","browser.lol","Virtual Browser - Safely visit blocked or risky websites - can be used to bypass network restrictions within a corporate environment","T1071 - T1090 - T1562","TA0005","N/A","N/A","Defense Evasion","https://browser.lol","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*.static.mega.co.nz*",".{0,1000}\.static\.mega\.co\.nz.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","#filehostingservice #P2P","N/A","10","10","N/A","N/A","N/A","N/A"
"*.trycloudfare.com*DavWWWRoot*",".{0,1000}\.trycloudfare\.com.{0,1000}DavWWWRoot.{0,1000}","greyware_tool_keyword","trycloudflare.com","The subdomain .trycloudflare.com is a temporary hostname provided by Cloudflare Tunnel - It allows users to expose local services to the internet without needing to configure port forwarding or a public IP - attackers frequently abuse it for malicious activities","T1071.001 - T1090 - T1583.003 - T1102","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","Phishing","https://www.forcepoint.com/blog/x-labs/asyncrat-python-trycloudflare-malware","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.tunnel.pyjam.as*",".{0,1000}\.tunnel\.pyjam\.as.{0,1000}","greyware_tool_keyword","tunnel","SSL-terminated ephemeral HTTP tunnels to your local machine","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://gitlab.com/pyjam.as/tunnel","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.tunnelto.dev*",".{0,1000}\.tunnelto\.dev.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*.userstorage.mega.co.nz/ul/*",".{0,1000}\.userstorage\.mega\.co\.nz\/ul\/.{0,1000}","greyware_tool_keyword","mega.co.nz","uploading data to mega cloud","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR - Dispossessor","Data Exfiltration","https://mega.io/","1","1","#filehostingservice #P2P","N/A","10","10","N/A","N/A","N/A","N/A"
"*.v2.argotunnel.com*",".{0,1000}\.v2\.argotunnel\.com.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","N/A","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*.xeox.com*",".{0,1000}\.xeox\.com.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.zohoassist.com.cn*",".{0,1000}\.zohoassist\.com\.cn.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.zohoassist.jp*",".{0,1000}\.zohoassist\.jp.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.zrok.quigley.com*",".{0,1000}\.zrok\.quigley\.com.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*/*.loclx.io*",".{0,1000}\/.{0,1000}\.loclx\.io.{0,1000}","greyware_tool_keyword","localxpose","LocalXpose is a reverse proxy that enables you to expose your localhost to the internet","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://localxpose.io/","1","1","N/A","N/A","10","1","N/A","N/A","N/A","N/A"
"*/3proxy-*.deb*",".{0,1000}\/3proxy\-.{0,1000}\.deb.{0,1000}","greyware_tool_keyword","3proxy","3proxy - tiny free proxy server","T1090 - T1583 - T1001 - T1132","TA0040 - TA0001 - TA0005 - TA0006","N/A","Lazarus Group","Defense Evasion","https://github.com/3proxy/3proxy","1","1","N/A","N/A","8","10","4103","800","2024-12-20T11:39:04Z","2014-04-08T08:59:11Z"
"*/3proxy-*.rpm*",".{0,1000}\/3proxy\-.{0,1000}\.rpm.{0,1000}","greyware_tool_keyword","3proxy","3proxy - tiny free proxy server","T1090 - T1583 - T1001 - T1132","TA0040 - TA0001 - TA0005 - TA0006","N/A","Lazarus Group","Defense Evasion","https://github.com/3proxy/3proxy","1","1","N/A","N/A","8","10","4103","800","2024-12-20T11:39:04Z","2014-04-08T08:59:11Z"
"*/3proxy-*.zip*",".{0,1000}\/3proxy\-.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","3proxy","3proxy - tiny free proxy server","T1090 - T1583 - T1001 - T1132","TA0040 - TA0001 - TA0005 - TA0006","N/A","Lazarus Group","Defense Evasion","https://github.com/3proxy/3proxy","1","1","N/A","N/A","8","10","4103","800","2024-12-20T11:39:04Z","2014-04-08T08:59:11Z"
"*/3proxy.exe*",".{0,1000}\/3proxy\.exe.{0,1000}","greyware_tool_keyword","3proxy","3proxy - tiny free proxy server","T1090 - T1583 - T1001 - T1132","TA0040 - TA0001 - TA0005 - TA0006","N/A","Lazarus Group","Defense Evasion","https://github.com/3proxy/3proxy","1","1","N/A","N/A","8","10","4103","800","2024-12-20T11:39:04Z","2014-04-08T08:59:11Z"
"*/3proxy.git*",".{0,1000}\/3proxy\.git.{0,1000}","greyware_tool_keyword","3proxy","3proxy - tiny free proxy server","T1090 - T1583 - T1001 - T1132","TA0040 - TA0001 - TA0005 - TA0006","N/A","Lazarus Group","Defense Evasion","https://github.com/3proxy/3proxy","1","1","N/A","N/A","8","10","4103","800","2024-12-20T11:39:04Z","2014-04-08T08:59:11Z"
"*/3proxy.log*",".{0,1000}\/3proxy\.log.{0,1000}","greyware_tool_keyword","3proxy","3proxy - tiny free proxy server","T1090 - T1583 - T1001 - T1132","TA0040 - TA0001 - TA0005 - TA0006","N/A","Lazarus Group","Defense Evasion","https://github.com/3proxy/3proxy","1","1","#logfile #linux","N/A","8","10","4103","800","2024-12-20T11:39:04Z","2014-04-08T08:59:11Z"
"*/a.pinggy.io*",".{0,1000}\/a\.pinggy\.io.{0,1000}","greyware_tool_keyword","pinggy","Create HTTP/TCP or TLS tunnels to your Mac/PC. Even if it is sitting behind firewalls and NATs.","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://pinggy.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/AADInternals.git*",".{0,1000}\/AADInternals\.git.{0,1000}","greyware_tool_keyword","AADInternals","AADInternals PowerShell module for administering Azure AD and Office 365","T1583 - T1558 - T1078 - T1136 - T1087 - T1114 - T1566 - T1056 - T1199 - T1098 - T1649 - T1621 - T1649","TA0006 - TA0003 - TA0004 - TA0005 - TA0007 - TA0009 - TA0011","N/A","APT29 - COZY BEAR","Exploitation tool","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","9","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*/action1_agent(My_Organization).msi*",".{0,1000}\/action1_agent\(My_Organization\)\.msi.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","product name","10","10","N/A","N/A","N/A","N/A"
"*/AD_Miner.git*",".{0,1000}\/AD_Miner\.git.{0,1000}","greyware_tool_keyword","AD_Miner","AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security weaknesses","T1482 - T1069 - T1087","TA0007 ","N/A","EMBER BEAR","Discovery","https://github.com/Mazars-Tech/AD_Miner","1","1","N/A","N/A","6","10","1246","127","2025-02-28T09:22:28Z","2023-09-26T12:36:59Z"
"*/AD_Miner/releases/*",".{0,1000}\/AD_Miner\/releases\/.{0,1000}","greyware_tool_keyword","AD_Miner","AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security weaknesses","T1482 - T1069 - T1087","TA0007 ","N/A","EMBER BEAR","Discovery","https://github.com/Mazars-Tech/AD_Miner","1","1","N/A","N/A","6","10","1246","127","2025-02-28T09:22:28Z","2023-09-26T12:36:59Z"
"*/adaudit.git*",".{0,1000}\/adaudit\.git.{0,1000}","greyware_tool_keyword","adaudit","Powershell script to do domain auditing automation","T1482 - T1087","TA0007","N/A","N/A","Discovery","https://github.com/phillips321/adaudit","1","1","N/A","N/A","8","4","386","104","2024-11-15T10:37:29Z","2018-04-20T11:29:06Z"
"*/adaudit.ps1*",".{0,1000}\/adaudit\.ps1.{0,1000}","greyware_tool_keyword","adaudit","Powershell script to do domain auditing automation","T1482 - T1087","TA0007","N/A","N/A","Discovery","https://github.com/phillips321/adaudit","1","1","N/A","N/A","8","4","386","104","2024-11-15T10:37:29Z","2018-04-20T11:29:06Z"
"*/AD-common-queries.git*",".{0,1000}\/AD\-common\-queries\.git.{0,1000}","greyware_tool_keyword","AD-common-queries","Collection of common ADSI queries for Domain Account enumeration","T1087 - T1087.002 - T1018 - T1069 - T1069.002 - T1069.003 - T1133 - T1139","TA0007 - TA0009","N/A","N/A","Discovery","https://github.com/swarleysez/AD-common-queries","1","1","N/A","N/A","8","1","7","3","2020-05-24T03:23:09Z","2020-03-10T19:43:51Z"
"*/AdFind.zip*",".{0,1000}\/AdFind\.zip.{0,1000}","greyware_tool_keyword","adfind","adfind is a command-line tool often used by administrators for Active Directory queries. However. attackers are abusing it to gather valuable information about the network environment","T1087 - T1016 - T1482","TA0007 - TA0008 - TA0043","N/A","APT29 - Akira - Black Basta - BlackSuit - Conti - COZY BEAR - Dagon Locker - Diavol - FIN6 - FIN7 - INC Ransom - LockBit - MAZE - MUSTANG PANDA - NetWalker - Nokoyawa - PLAY - Quantum - REvil - Royal - Ryuk - TA505 - TRAVELING SPIDER - Unit 29155 - WIZARD SPIDER - Wizard Spider - XingLocker - menuPass - Dispossessor","Discovery","https://www.virustotal.com/gui/file/484dd00e85c033fbfd506b956ac0acd29b30f239755ed753a2788a842425b384/behavior","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/ADGet.exe*",".{0,1000}\\ADGet\.exe.{0,1000}","greyware_tool_keyword","adget","gather valuable informations about the AD environment","T1018 - T1027 - T1046 - T1057 - T1069 - T1087 - T1098 - T1482","TA0001 - TA0002 - TA0003 - TA0007 - TA0011","N/A","N/A","Discovery","https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/ADRecon*",".{0,1000}\/ADRecon.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner and Earth Lusca Operations Tools and commands","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://github.com/sense-of-security/ADRecon","1","1","N/A","N/A","10","10","1773","288","2020-06-15T05:23:14Z","2017-11-29T23:01:53Z"
"*/ADRecon.ps1*",".{0,1000}\/ADRecon\.ps1.{0,1000}","greyware_tool_keyword","adrecon","ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.","T1018 - T1087.001 - T1069.001 - T1003.002 - T1482","TA0007 - TA0009 - TA0040","N/A","Scattered Spider*","Discovery","https://github.com/adrecon/ADRecon","1","1","N/A","AD Enumeration","7","8","755","107","2024-10-15T03:41:29Z","2018-12-15T13:00:09Z"
"*/Advanced_Port_Scanner_*.exe*",".{0,1000}\/Advanced_Port_Scanner_.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","advanced port scanner","port scanner tool abused by ransomware actors","T1135 - T1021 - T1016 - T1046","TA0007 - TA0043","N/A","Dispossessor - LockBit - BianLian - PYSA - Trigona - EvilCorp* - Fog - Scattered Spider* - INDRIK SPIDER - Medusa Locker","Discovery","https://www.advanced-port-scanner.com/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*/Ahk2Exe.exe*",".{0,1000}\/Ahk2Exe\.exe.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*/Ahk2Exe.git*",".{0,1000}\/Ahk2Exe\.git.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*/Ahk2Exe.zip*",".{0,1000}\/Ahk2Exe\.zip.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*/Ahk2Exe1.*.zip*",".{0,1000}\/Ahk2Exe1\..{0,1000}\.zip.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*/ahk-install.exe*",".{0,1000}\/ahk\-install\.exe.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*/ahk-v2.exe*",".{0,1000}\/ahk\-v2\.exe.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*/Alpemix.zip*",".{0,1000}\/Alpemix\.zip.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/amalshaji/portr-admin/*",".{0,1000}\/amalshaji\/portr\-admin\/.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/amidaware/rmmagent/releases/download/*",".{0,1000}\/amidaware\/rmmagent\/releases\/download\/.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/Amperage.exe*",".{0,1000}\/Amperage\.exe.{0,1000}","greyware_tool_keyword","AmperageKit","enabling Recall in Windows 11 version 24H2 on unsupported devices","T1005 - T1113 - T1056.001 - T1003","TA0009 - TA0010 - TA0006 - TA0007","N/A","N/A","Sniffing & Spoofing","https://github.com/thebookisclosed/AmperageKit","1","1","N/A","N/A","8","4","398","27","2024-06-21T16:37:12Z","2024-05-30T23:00:45Z"
"*/AmperageKit.git*",".{0,1000}\/AmperageKit\.git.{0,1000}","greyware_tool_keyword","AmperageKit","enabling Recall in Windows 11 version 24H2 on unsupported devices","T1005 - T1113 - T1056.001 - T1003","TA0009 - TA0010 - TA0006 - TA0007","N/A","N/A","Sniffing & Spoofing","https://github.com/thebookisclosed/AmperageKit","1","1","N/A","N/A","8","4","398","27","2024-06-21T16:37:12Z","2024-05-30T23:00:45Z"
"*/AmperageKit/releases/*",".{0,1000}\/AmperageKit\/releases\/.{0,1000}","greyware_tool_keyword","AmperageKit","enabling Recall in Windows 11 version 24H2 on unsupported devices","T1005 - T1113 - T1056.001 - T1003","TA0009 - TA0010 - TA0006 - TA0007","N/A","N/A","Sniffing & Spoofing","https://github.com/thebookisclosed/AmperageKit","1","1","N/A","N/A","8","4","398","27","2024-06-21T16:37:12Z","2024-05-30T23:00:45Z"
"*/Anydesk.exe",".{0,1000}\/Anydesk\.exe","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","1","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/anyplace-control/data2/*.exe*",".{0,1000}\/anyplace\-control\/data2\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/AnyViewerSetup.exe*",".{0,1000}\/AnyViewerSetup\.exe.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Apemix.exe*",".{0,1000}\/Apemix\.exe.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/api/latest/fleet/mdm/bootstrap?token=*",".{0,1000}\/api\/latest\/fleet\/mdm\/bootstrap\?token\=.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*/api/v1/fleet/mdm/sso/callback*",".{0,1000}\/api\/v1\/fleet\/mdm\/sso\/callback.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*/Assistance rapide Installer.exe*",".{0,1000}\/Assistance\srapide\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*/Assistenza rapida Installer.exe*",".{0,1000}\/Assistenza\srapida\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*/atnow.exe*",".{0,1000}\/atnow\.exe.{0,1000}","greyware_tool_keyword","atnow","AtNow is a command-line utility that schedules programs and commands to run in the near future - abused by TA","T1053 - T1059","TA0002 ","N/A","APT18 - APT29 - APT32 - Cobalt - RTM","Persistence","https://www.nirsoft.net/utils/atnow.html","1","1","N/A","N/A","7","7","N/A","N/A","N/A","N/A"
"*/atnow.zip*",".{0,1000}\/atnow\.zip.{0,1000}","greyware_tool_keyword","atnow","AtNow is a command-line utility that schedules programs and commands to run in the near future - abused by TA","T1053 - T1059","TA0002 ","N/A","APT18 - APT29 - APT32 - Cobalt - RTM","Persistence","https://www.nirsoft.net/utils/atnow.html","1","1","N/A","N/A","7","7","N/A","N/A","N/A","N/A"
"*/AttendedUDP.zip*",".{0,1000}\/AttendedUDP\.zip.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/AutoHotkey.exe*",".{0,1000}\/AutoHotkey\.exe.{0,1000}","greyware_tool_keyword","AutoHotkey","AutoHotkey - macro-creation and automation-oriented scripting utility for Windows","T1056.001 - T1027 - T1059.001 - T1140","TA0005 - TA0002","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/AutoHotkey","1","1","N/A","abused by multiple threat actors https://thehackernews.com/2024/06/darkgate-malware-replaces-autoit-with.html - False positives expected","6","10","9869","983","2025-02-02T21:27:58Z","2009-11-25T11:08:21Z"
"*/AutoHotkey.git*",".{0,1000}\/AutoHotkey\.git.{0,1000}","greyware_tool_keyword","AutoHotkey","AutoHotkey - macro-creation and automation-oriented scripting utility for Windows","T1056.001 - T1027 - T1059.001 - T1140","TA0005 - TA0002","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/AutoHotkey","1","1","N/A","abused by multiple threat actors https://thehackernews.com/2024/06/darkgate-malware-replaces-autoit-with.html - False positives expected","6","10","9869","983","2025-02-02T21:27:58Z","2009-11-25T11:08:21Z"
"*/AutoHotkey/releases/download/*",".{0,1000}\/AutoHotkey\/releases\/download\/.{0,1000}","greyware_tool_keyword","AutoHotkey","AutoHotkey - macro-creation and automation-oriented scripting utility for Windows","T1056.001 - T1027 - T1059.001 - T1140","TA0005 - TA0002","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/AutoHotkey","1","1","N/A","abused by multiple threat actors https://thehackernews.com/2024/06/darkgate-malware-replaces-autoit-with.html - False positives expected","6","10","9869","983","2025-02-02T21:27:58Z","2009-11-25T11:08:21Z"
"*/AutoHotkey_*.zip*",".{0,1000}\/AutoHotkey_.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","AutoHotkey","AutoHotkey - macro-creation and automation-oriented scripting utility for Windows","T1056.001 - T1027 - T1059.001 - T1140","TA0005 - TA0002","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/AutoHotkey","1","1","N/A","abused by multiple threat actors https://thehackernews.com/2024/06/darkgate-malware-replaces-autoit-with.html - False positives expected","6","10","9869","983","2025-02-02T21:27:58Z","2009-11-25T11:08:21Z"
"*/AutoHotkey_1*_setup.exe*",".{0,1000}\/AutoHotkey_1.{0,1000}_setup\.exe.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*/AutoHotkey_2*_setup.exe*",".{0,1000}\/AutoHotkey_2.{0,1000}_setup\.exe.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*/AutoHotkey64.exe*",".{0,1000}\/AutoHotkey64\.exe.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*/AutoHotkey64.exe*",".{0,1000}\/AutoHotkey64\.exe.{0,1000}","greyware_tool_keyword","AutoHotkey","AutoHotkey - macro-creation and automation-oriented scripting utility for Windows","T1056.001 - T1027 - T1059.001 - T1140","TA0005 - TA0002","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/AutoHotkey","1","1","N/A","abused by multiple threat actors https://thehackernews.com/2024/06/darkgate-malware-replaces-autoit-with.html - False positives expected","6","10","9869","983","2025-02-02T21:27:58Z","2009-11-25T11:08:21Z"
"*/Aweray_Remote_*.exe*",".{0,1000}\/Aweray_Remote_.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Aweray_Remote_*.zip*",".{0,1000}\/Aweray_Remote_.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/bin/x64/connectd.exe*",".{0,1000}\/bin\/x64\/connectd\.exe.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/desktop","1","1","#linux","N/A","10","10","44","11","2025-01-22T07:41:56Z","2019-01-12T00:59:20Z"
"*/BitLockerToGo.exe*",".{0,1000}\/BitLockerToGo\.exe.{0,1000}","greyware_tool_keyword","BitLockerToGo","BitLocker To Go is legitimate Windows utility used for managing BitLocker encryption - abused by Malware like LummaSteale to manipulate registry keys -  search for cryptocurrency wallets and credentials and exfiltrate sensitive data","T1218 - T1055 - T1112 - T1056 - T1555","TA0005 - TA0007 - TA0009","Lumma Stealer","N/A","Defense Evasion","https://securelist.com/fake-captcha-delivers-lumma-amadey/114312/","0","1","N/A","high FP - hunting only","3","8","N/A","N/A","N/A","N/A"
"*/bomgar-rep.exe*",".{0,1000}\/bomgar\-rep\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/bomgar-scc-*.exe*",".{0,1000}\/bomgar\-scc\-.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/bomgar-scc.exe*",".{0,1000}\/bomgar\-scc\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/boringproxy.git*",".{0,1000}\/boringproxy\.git.{0,1000}","greyware_tool_keyword","boringproxy","Simple tunneling reverse proxy with a fast web UI and auto HTTPS. Designed for self-hosters.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/boringproxy/boringproxy","1","1","N/A","N/A","10","10","1258","119","2024-07-06T10:13:37Z","2020-09-26T21:58:07Z"
"*/boringproxy-client.service*",".{0,1000}\/boringproxy\-client\.service.{0,1000}","greyware_tool_keyword","boringproxy","Simple tunneling reverse proxy with a fast web UI and auto HTTPS. Designed for self-hosters.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/boringproxy/boringproxy","1","1","N/A","N/A","10","10","1258","119","2024-07-06T10:13:37Z","2020-09-26T21:58:07Z"
"*/boringproxy-server.service*",".{0,1000}\/boringproxy\-server\.service.{0,1000}","greyware_tool_keyword","boringproxy","Simple tunneling reverse proxy with a fast web UI and auto HTTPS. Designed for self-hosters.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/boringproxy/boringproxy","1","1","N/A","N/A","10","10","1258","119","2024-07-06T10:13:37Z","2020-09-26T21:58:07Z"
"*/BoxDrive.msi*",".{0,1000}\/BoxDrive\.msi.{0,1000}","greyware_tool_keyword","Box","Attackers have used box to store malicious files and then share them with targets - box can also be used for data exfiltration by attackers","T1567.002 - T1071.001 - T1036 - T1048.002","TA0005 - TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://app.box.com/","1","1","N/A","N/A","6","7","N/A","N/A","N/A","N/A"
"*/btunnel.exe*",".{0,1000}\/btunnel\.exe.{0,1000}","greyware_tool_keyword","btunnel","Btunnel is a publicly accessible reverse proxy","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://www.btunnel.in","1","1","N/A","N/A","9","8","N/A","N/A","N/A","N/A"
"*/cloudflared.git*",".{0,1000}\/cloudflared\.git.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","N/A","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*/cloudflared-linux-*.deb*",".{0,1000}\/cloudflared\-linux\-.{0,1000}\.deb.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","#linux","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*/cloudflared-linux-*.rpm*",".{0,1000}\/cloudflared\-linux\-.{0,1000}\.rpm.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","#linux","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*/cmd/tailscaled*",".{0,1000}\/cmd\/tailscaled.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/config/apps/http/servers/sirtunnel/routes*",".{0,1000}\/config\/apps\/http\/servers\/sirtunnel\/routes.{0,1000}","greyware_tool_keyword","SirTunnel","SirTunnel enables you to securely expose a webserver running on your computer to a public URL using HTTPS.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/anderspitman/SirTunnel","1","1","N/A","N/A","10","10","1404","119","2024-03-24T20:15:50Z","2020-09-23T00:15:26Z"
"*/connectd.aarch64-win.exe*",".{0,1000}\/connectd\.aarch64\-win\.exe.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/desktop","1","1","N/A","N/A","10","10","44","11","2025-01-22T07:41:56Z","2019-01-12T00:59:20Z"
"*/connectd.x86_64-win.exe*",".{0,1000}\/connectd\.x86_64\-win\.exe.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/desktop","1","1","N/A","N/A","10","10","44","11","2025-01-22T07:41:56Z","2019-01-12T00:59:20Z"
"*/croc.exe*",".{0,1000}\/croc\.exe.{0,1000}","greyware_tool_keyword","croc","croc is a tool that allows any two computers to simply and securely transfer files and folders","T1567.002 - T1090.002 - T1573.002 - T1102.003","TA0010 - TA0005 - TA0008 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/schollz/croc","1","1","N/A","N/A","8","10","28838","1143","2025-02-25T09:03:12Z","2017-10-17T15:20:18Z"
"*/croc/releases/download/v10*",".{0,1000}\/croc\/releases\/download\/v10.{0,1000}","greyware_tool_keyword","croc","croc is a tool that allows any two computers to simply and securely transfer files and folders","T1567.002 - T1090.002 - T1573.002 - T1102.003","TA0010 - TA0005 - TA0008 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/schollz/croc","1","1","N/A","N/A","8","10","28838","1143","2025-02-25T09:03:12Z","2017-10-17T15:20:18Z"
"*/croc/releases/latest*",".{0,1000}\/croc\/releases\/latest.{0,1000}","greyware_tool_keyword","croc","croc is a tool that allows any two computers to simply and securely transfer files and folders","T1567.002 - T1090.002 - T1573.002 - T1102.003","TA0010 - TA0005 - TA0008 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/schollz/croc","1","1","N/A","N/A","8","10","28838","1143","2025-02-25T09:03:12Z","2017-10-17T15:20:18Z"
"*/crowbar.git*",".{0,1000}\/crowbar\.git.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","N/A","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_darwin_386.zip*",".{0,1000}\/crowbar_1\.0\.0_darwin_386\.zip.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","#linux","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_darwin_amd64.zip*",".{0,1000}\/crowbar_1\.0\.0_darwin_amd64\.zip.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","#linux","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_freebsd_386.zip*",".{0,1000}\/crowbar_1\.0\.0_freebsd_386\.zip.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","N/A","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_freebsd_amd64.zip*",".{0,1000}\/crowbar_1\.0\.0_freebsd_amd64\.zip.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","N/A","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_freebsd_arm.zip*",".{0,1000}\/crowbar_1\.0\.0_freebsd_arm\.zip.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","N/A","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_linux_386.tar.gz*",".{0,1000}\/crowbar_1\.0\.0_linux_386\.tar\.gz.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","#linux","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_linux_amd64.tar.gz*",".{0,1000}\/crowbar_1\.0\.0_linux_amd64\.tar\.gz.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","#linux","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_linux_arm.tar.gz*",".{0,1000}\/crowbar_1\.0\.0_linux_arm\.tar\.gz.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","#linux","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_openbsd_386.zip*",".{0,1000}\/crowbar_1\.0\.0_openbsd_386\.zip.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","N/A","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_openbsd_amd64.zip*",".{0,1000}\/crowbar_1\.0\.0_openbsd_amd64\.zip.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","N/A","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_windows_386.zip*",".{0,1000}\/crowbar_1\.0\.0_windows_386\.zip.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","N/A","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/crowbar_1.0.0_windows_amd64.zip*",".{0,1000}\/crowbar_1\.0\.0_windows_amd64\.zip.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","N/A","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*/damewareagent.exe*",".{0,1000}\/damewareagent\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/dataplicity-agent.git*",".{0,1000}\/dataplicity\-agent\.git.{0,1000}","greyware_tool_keyword","Dataplicity","enables connecting local systems to dataplicity cloud for remotely accessing them over the internet.","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/wildfoundry/dataplicity-agent","1","1","N/A","N/A","9","2","167","32","2024-06-10T20:17:43Z","2016-07-27T14:23:01Z"
"*/dataplicity-agent/releases/download*",".{0,1000}\/dataplicity\-agent\/releases\/download.{0,1000}","greyware_tool_keyword","Dataplicity","enables connecting local systems to dataplicity cloud for remotely accessing them over the internet.","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/wildfoundry/dataplicity-agent","1","1","N/A","N/A","9","2","167","32","2024-06-10T20:17:43Z","2016-07-27T14:23:01Z"
"*/download*mediafire.com/",".{0,1000}\/download.{0,1000}mediafire\.com\/","greyware_tool_keyword","mediafire","downloading from mediafire","T1105 - T1083 - T1560","TA0009 ","N/A","Black Basta","Collection","N/A","1","1","#filehostingservice","N/A","7","8","N/A","N/A","N/A","N/A"
"*/download/fiddler/fiddler-everywhere-windows*",".{0,1000}\/download\/fiddler\/fiddler\-everywhere\-windows.{0,1000}","greyware_tool_keyword","fiddler","fiddler - capture https requests","T1056 - T1040 - T1557","TA0009 - TA00010","N/A","N/A","Collection","https://www.telerik.com/","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*/download/pcunlocker*",".{0,1000}\/download\/pcunlocker.{0,1000}","greyware_tool_keyword","pcunlocker","Reset and unlock forgotten Windows login password","T1078","TA0005 - TA0006 - TA0009","N/A","N/A","Credential Access","https://www.pcunlocker.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/downloads/ultravnc.html*",".{0,1000}\/downloads\/ultravnc\.html.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/dropbear.git*",".{0,1000}\/dropbear\.git.{0,1000}","greyware_tool_keyword","dropbear","A smallish SSH server and client","T1021.004 - T1570","TA0003","N/A","COZY BEAR","Persistence","https://github.com/mkj/dropbear","1","1","N/A","N/A","8","10","1814","407","2025-02-22T14:42:34Z","2013-03-19T11:15:36Z"
"*/dropbear/releases/*",".{0,1000}\/dropbear\/releases\/.{0,1000}","greyware_tool_keyword","dropbear","A smallish SSH server and client","T1021.004 - T1570","TA0003","N/A","COZY BEAR","Persistence","https://github.com/mkj/dropbear","1","1","N/A","N/A","8","10","1814","407","2025-02-22T14:42:34Z","2013-03-19T11:15:36Z"
"*/dropbear-sshj.git*",".{0,1000}\/dropbear\-sshj\.git.{0,1000}","greyware_tool_keyword","SSH-J.com","This is Dropbear SSH server modified to be used as a public SSH jump & port forwarding service","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://bitbucket.org/ValdikSS/dropbear-sshj/src/master/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/DuckDNS.7z*",".{0,1000}\/DuckDNS\.7z.{0,1000}","greyware_tool_keyword","duckdns.org","A simple C# DuckDNS updater - free dynamic DNS hosted on AWS - often used by threat actors for contacting C2","T1568.002 - T1071.001","TA0011 - TA0005","N/A","N/A","Defense Evasion","https://www.duckdns.org/install.jsp","1","1","N/A","N/A","5","10","N/A","N/A","N/A","N/A"
"*/DuckDNS.git*",".{0,1000}\/DuckDNS\.git.{0,1000}","greyware_tool_keyword","duckdns.org","A simple C# DuckDNS updater - free dynamic DNS hosted on AWS - often used by threat actors for contacting C2","T1568.002 - T1071.001","TA0011 - TA0005","N/A","N/A","Defense Evasion","https://www.duckdns.org/install.jsp","1","1","N/A","N/A","5","10","N/A","N/A","N/A","N/A"
"*/DuckDNS.zip""*",".{0,1000}\/DuckDNS\.zip\"".{0,1000}","greyware_tool_keyword","duckdns.org","A simple C# DuckDNS updater - free dynamic DNS hosted on AWS - often used by threat actors for contacting C2","T1568.002 - T1071.001","TA0011 - TA0005","N/A","N/A","Defense Evasion","https://www.duckdns.org/install.jsp","1","1","N/A","N/A","5","10","N/A","N/A","N/A","N/A"
"*/duckdns/duck.log*",".{0,1000}\/duckdns\/duck\.log.{0,1000}","greyware_tool_keyword","duckdns.org","A simple C# DuckDNS updater - free dynamic DNS hosted on AWS - often used by threat actors for contacting C2","T1568.002 - T1071.001","TA0011 - TA0005","N/A","N/A","Defense Evasion","https://www.duckdns.org/install.jsp","1","1","#logfile #linux","N/A","5","10","N/A","N/A","N/A","N/A"
"*/duckdns/duck.sh*",".{0,1000}\/duckdns\/duck\.sh.{0,1000}","greyware_tool_keyword","duckdns.org","A simple C# DuckDNS updater - free dynamic DNS hosted on AWS - often used by threat actors for contacting C2","T1568.002 - T1071.001","TA0011 - TA0005","N/A","N/A","Defense Evasion","https://www.duckdns.org/install.jsp","1","1","N/A","N/A","5","10","N/A","N/A","N/A","N/A"
"*/duckdns-powershell.git*",".{0,1000}\/duckdns\-powershell\.git.{0,1000}","greyware_tool_keyword","duckdns.org","A simple C# DuckDNS updater - free dynamic DNS hosted on AWS - often used by threat actors for contacting C2","T1568.002 - T1071.001","TA0011 - TA0005","N/A","N/A","Defense Evasion","https://www.duckdns.org/install.jsp","1","1","N/A","N/A","5","10","N/A","N/A","N/A","N/A"
"*/DWMRC_St_64.msi*",".{0,1000}\/DWMRC_St_64\.msi.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*/DWRCC.exe*",".{0,1000}\/DWRCC\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*/DWRCCMD.exe*",".{0,1000}\/DWRCCMD\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*/DWRCS.exe*",".{0,1000}\/DWRCS\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*/ehorus_agent_installer-*",".{0,1000}\/ehorus_agent_installer\-.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Eraser 6.0.10.2620.exe*",".{0,1000}\/Eraser\s6\.0\.10\.2620\.exe.{0,1000}","greyware_tool_keyword","eraser","It completely removes sensitive data from your hard drive by overwriting it several times with carefully selected patterns - abusedby attackers for anti forensic","T1070 - T1488 - T1561","TA0005","N/A","BlackSuit - Royal","Defense Evasion","https://sourceforge.net/projects/eraser","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*/Eraser 6.0.8.2273.exe*",".{0,1000}\/Eraser\s6\.0\.8\.2273\.exe.{0,1000}","greyware_tool_keyword","eraser","It completely removes sensitive data from your hard drive by overwriting it several times with carefully selected patterns - abusedby attackers for anti forensic","T1070 - T1488 - T1561","TA0005","N/A","BlackSuit - Royal","Defense Evasion","https://sourceforge.net/projects/eraser","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*/Eraser 6.0.9.2343.exe*",".{0,1000}\/Eraser\s6\.0\.9\.2343\.exe.{0,1000}","greyware_tool_keyword","eraser","It completely removes sensitive data from your hard drive by overwriting it several times with carefully selected patterns - abusedby attackers for anti forensic","T1070 - T1488 - T1561","TA0005","N/A","BlackSuit - Royal","Defense Evasion","https://sourceforge.net/projects/eraser","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*/Eraser 6.2.0.2994.exe*",".{0,1000}\/Eraser\s6\.2\.0\.2994\.exe.{0,1000}","greyware_tool_keyword","eraser","It completely removes sensitive data from your hard drive by overwriting it several times with carefully selected patterns - abusedby attackers for anti forensic","T1070 - T1488 - T1561","TA0005","N/A","BlackSuit - Royal","Defense Evasion","https://sourceforge.net/projects/eraser","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*/EraserSetup.exe*",".{0,1000}\/EraserSetup\.exe.{0,1000}","greyware_tool_keyword","eraser","It completely removes sensitive data from your hard drive by overwriting it several times with carefully selected patterns - abusedby attackers for anti forensic","T1070 - T1488 - T1561","TA0005","N/A","BlackSuit - Royal","Defense Evasion","https://sourceforge.net/projects/eraser","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*/expose/database/expose.db*",".{0,1000}\/expose\/database\/expose\.db.{0,1000}","greyware_tool_keyword","expose","tunneling service - written in pure PHP","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/beyondcode/expose","1","1","N/A","N/A","10","10","4344","271","2025-02-28T13:35:11Z","2020-04-14T19:18:38Z"
"*/expose/raw/master/builds/expose*",".{0,1000}\/expose\/raw\/master\/builds\/expose.{0,1000}","greyware_tool_keyword","expose","tunneling service - written in pure PHP","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/beyondcode/expose","1","1","N/A","N/A","10","10","4344","271","2025-02-28T13:35:11Z","2020-04-14T19:18:38Z"
"*/Fiddler Everywhere *.*.*.exe*",".{0,1000}\/Fiddler\sEverywhere\s.{0,1000}\..{0,1000}\..{0,1000}\.exe.{0,1000}","greyware_tool_keyword","fiddler","fiddler - capture https requests","T1056 - T1040 - T1557","TA0009 - TA00010","N/A","N/A","Collection","https://www.telerik.com/","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*/FileZilla_*_sponsored-setup.exe*",".{0,1000}\/FileZilla_.{0,1000}_sponsored\-setup\.exe.{0,1000}","greyware_tool_keyword","FileZilla","FileZilla admintool used by threat actors for persistence and data exfiltration","T1505 - T1041","TA0003 - TA0009 -TA0010","N/A","Dispossessor - Akira - Karakurt - AvosLocker - LockBit - Nokoyawa - Diavol - Scattered Spider* - Unit 29155","Data Exfiltration","https://filezilla-project.org/","1","1","N/A","PUA risk of legitimate usage","5","7","N/A","N/A","N/A","N/A"
"*/FileZilla_Server_*.deb*",".{0,1000}\/FileZilla_Server_.{0,1000}\.deb.{0,1000}","greyware_tool_keyword","FileZilla","FileZilla admintool used by threat actors for persistence and data exfiltration","T1505 - T1041","TA0003 - TA0009 -TA0010","N/A","Dispossessor - Akira - Karakurt - AvosLocker - LockBit - Nokoyawa - Diavol - Scattered Spider* - Unit 29155","Data Exfiltration","https://filezilla-project.org/","1","1","N/A","PUA risk of legitimate usage","5","7","N/A","N/A","N/A","N/A"
"*/fleet_v*_linux.tar.gz*",".{0,1000}\/fleet_v.{0,1000}_linux\.tar\.gz.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","#linux","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*/fleetd.crx*",".{0,1000}\/fleetd\.crx.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*/fleetdm/fleet/releases/download/*",".{0,1000}\/fleetdm\/fleet\/releases\/download\/.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*/fleetdm/fleet/releases/latest*",".{0,1000}\/fleetdm\/fleet\/releases\/latest.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*/FreeFileSync.exe*",".{0,1000}\/FreeFileSync\.exe.{0,1000}","greyware_tool_keyword","freefilesync","freefilesync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","LockBit","Data Exfiltration","https://freefilesync.org/download.php","1","1","N/A","N/A","9","10","N/A","N/A","N/A","N/A"
"*/FreeFileSync.tar.gz*",".{0,1000}\/FreeFileSync\.tar\.gz.{0,1000}","greyware_tool_keyword","freefilesync","freefilesync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","LockBit","Data Exfiltration","https://freefilesync.org/download.php","1","1","N/A","N/A","9","10","N/A","N/A","N/A","N/A"
"*/FreeFileSync_*.tar.gz*",".{0,1000}\/FreeFileSync_.{0,1000}\.tar\.gz.{0,1000}","greyware_tool_keyword","freefilesync","freefilesync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","LockBit","Data Exfiltration","https://freefilesync.org/download.php","1","1","N/A","N/A","9","10","N/A","N/A","N/A","N/A"
"*/FreeFileSync_*_Windows_Setup.exe*",".{0,1000}\/FreeFileSync_.{0,1000}_Windows_Setup\.exe.{0,1000}","greyware_tool_keyword","freefilesync","freefilesync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","LockBit","Data Exfiltration","https://freefilesync.org/download.php","1","1","N/A","N/A","9","10","N/A","N/A","N/A","N/A"
"*/FreeFileSync_x64.exe*",".{0,1000}\/FreeFileSync_x64\.exe.{0,1000}","greyware_tool_keyword","freefilesync","freefilesync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","LockBit","Data Exfiltration","https://freefilesync.org/download.php","1","1","N/A","N/A","9","10","N/A","N/A","N/A","N/A"
"*/FreeFileSyncPortable_*.exe*",".{0,1000}\/FreeFileSyncPortable_.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","freefilesync","freefilesync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","LockBit","Data Exfiltration","https://freefilesync.org/download.php","1","1","N/A","N/A","9","10","N/A","N/A","N/A","N/A"
"*/frp.git*",".{0,1000}\/frp\.git.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frp_0.*.*_darwin_amd64.tar.gz*",".{0,1000}\/frp_0\..{0,1000}\..{0,1000}_darwin_amd64\.tar\.gz.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frp_0.*.*_darwin_arm64.tar.gz*",".{0,1000}\/frp_0\..{0,1000}\..{0,1000}_darwin_arm64\.tar\.gz.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frp_0.*.*_freebsd_amd64.tar.gz*",".{0,1000}\/frp_0\..{0,1000}\..{0,1000}_freebsd_amd64\.tar\.gz.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frp_0.*.*_linux_amd64.tar.gz*",".{0,1000}\/frp_0\..{0,1000}\..{0,1000}_linux_amd64\.tar\.gz.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frp_0.*.*_linux_arm.tar.gz*",".{0,1000}\/frp_0\..{0,1000}\..{0,1000}_linux_arm\.tar\.gz.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frp_0.*.*_linux_arm64.tar.gz*",".{0,1000}\/frp_0\..{0,1000}\..{0,1000}_linux_arm64\.tar\.gz.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frp_0.*.*_linux_mips.tar.gz*",".{0,1000}\/frp_0\..{0,1000}\..{0,1000}_linux_mips\.tar\.gz.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frp_0.*.*_linux_mips64.tar.gz*",".{0,1000}\/frp_0\..{0,1000}\..{0,1000}_linux_mips64\.tar\.gz.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frp_0.*.*_linux_mips64le.tar.gz*",".{0,1000}\/frp_0\..{0,1000}\..{0,1000}_linux_mips64le\.tar\.gz.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frp_0.*.*_linux_mipsle.tar.gz*",".{0,1000}\/frp_0\..{0,1000}\..{0,1000}_linux_mipsle\.tar\.gz.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","#linux","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/frpc.exe*",".{0,1000}\/frpc\.exe.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","N/A","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*/github.com*.exe?raw=true*",".{0,1000}\/github\.com.{0,1000}\.exe\?raw\=true.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/archive/refs/tags/*.zip*",".{0,1000}\/github\.com\/.{0,1000}\/archive\/refs\/tags\/.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.7z*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.7z.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.apk*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.apk.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.app*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.app.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.as*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.as.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.asc*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.asc.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.asp*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.asp.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.bash*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bash.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","#linux","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.bat*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bat.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.beacon*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.beacon.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.bin*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bin.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.bpl*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.bpl.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.c*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.c.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.cer*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cer.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.cmd*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cmd.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.com*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.com.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.cpp*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cpp.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.crt*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.crt.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.cs*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.cs.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.csh*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.csh.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.dat*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.dat.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.dll*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.dll.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.docm*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.docm.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.dos*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.dos.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.exe*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.go*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.go.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.gz*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.gz.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.hta*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.hta.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.iso*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.iso.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.jar*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.jar.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.js*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.js.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.lnk*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.lnk.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.log*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.log.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.mac*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.mac.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.mam*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.mam.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.msi*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.msp*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.msp.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.nexe*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.nexe.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.nim*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.nim.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.otm*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.otm.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.out*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.out.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.ova*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ova.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.pem*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pem.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.pfx*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pfx.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.pl*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pl.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.plx*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.plx.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.pm*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pm.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.ppk*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ppk.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.ps1*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ps1.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.psm1*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.psm1.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.pub*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pub.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.py*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.py.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.pyc*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pyc.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.pyo*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.pyo.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.rar*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.rar.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.raw*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.raw.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.reg*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.reg.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.rgs*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.rgs.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.RGS*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.RGS.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.run*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.run.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.scpt*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.scpt.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.script*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.script.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.sct*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.sct.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.sh*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.sh.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.ssh*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ssh.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.sys*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.sys.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.teamserver*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.teamserver.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.temp*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.temp.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.tgz*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.tgz.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.tmp*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.tmp.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.vb*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.vb.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.vbs*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.vbs.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.vbscript*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.vbscript.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.ws*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.ws.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.wsf*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.wsf.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.wsh*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.wsh.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.X86*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.X86.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.X86_64*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.X86_64.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.xlam*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.xlam.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.xlm*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.xlm.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.xlsm*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.xlsm.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/main/*.zip*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/main\/.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.7z*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.7z.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.apk*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.apk.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.bat*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.bat.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.cmd*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.cmd.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.com*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.com.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.cpl*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.cpl.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.dll*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.dll.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.exe*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.hta*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.hta.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.iso*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.iso.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.jar*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.jar.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.lnk*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.lnk.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.msi*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.pif*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.pif.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.ps1*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.ps1.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.py*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.py.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.reg*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.reg.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.scr*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.scr.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.sh*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.sh.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.vbs*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.vbs.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.vbs*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.vbs.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/github.com/*/raw/refs/heads/*.zip*",".{0,1000}\/github\.com\/.{0,1000}\/raw\/refs\/heads\/.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*/go-gost/core/*",".{0,1000}\/go\-gost\/core\/.{0,1000}","greyware_tool_keyword","gost","GO Simple Tunnel - a simple tunnel written in golang","T1572","TA0011 - TA0003","N/A","Dispossessor - EMBER BEAR","C2","https://github.com/go-gost/gost","1","1","N/A","N/A","10","10","4729","550","2025-02-18T15:35:15Z","2020-02-12T14:58:08Z"
"*/go-http-tunnel.git.git*",".{0,1000}\/go\-http\-tunnel\.git\.git.{0,1000}","greyware_tool_keyword","go-http-tunnel","Fast and secure tunnels over HTTP/2","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/mmatczuk/go-http-tunnel","1","1","N/A","N/A","10","10","3251","310","2024-04-19T12:25:30Z","2016-10-12T12:59:38Z"
"*/go-http-tunnel/cmd/*",".{0,1000}\/go\-http\-tunnel\/cmd\/.{0,1000}","greyware_tool_keyword","go-http-tunnel","Fast and secure tunnels over HTTP/2","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/mmatczuk/go-http-tunnel","1","1","N/A","N/A","10","10","3251","310","2024-04-19T12:25:30Z","2016-10-12T12:59:38Z"
"*/go-localtunnel.git*",".{0,1000}\/go\-localtunnel\.git.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/NoahShen/gotunnelme","1","1","N/A","N/A","10","10","170","46","2018-01-06T04:41:15Z","2013-10-18T02:46:51Z"
"*/GoodSync-vsub-Setup.exe*",".{0,1000}\/GoodSync\-vsub\-Setup\.exe.{0,1000}","greyware_tool_keyword","Goodsync","GoodSync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","N/A","Data Exfiltration","https://www.goodsync.com/","1","1","N/A","N/A","9","10","N/A","N/A","N/A","N/A"
"*/gost.tar.gz*",".{0,1000}\/gost\.tar\.gz.{0,1000}","greyware_tool_keyword","gost","GO Simple Tunnel - a simple tunnel written in golang","T1572","TA0011 - TA0003","N/A","Dispossessor - EMBER BEAR","C2","https://github.com/go-gost/gost","1","1","N/A","N/A","10","10","4729","550","2025-02-18T15:35:15Z","2020-02-12T14:58:08Z"
"*/gost/raw/master/install.sh*",".{0,1000}\/gost\/raw\/master\/install\.sh.{0,1000}","greyware_tool_keyword","gost","GO Simple Tunnel - a simple tunnel written in golang","T1572","TA0011 - TA0003","N/A","Dispossessor - EMBER BEAR","C2","https://github.com/go-gost/gost","1","1","N/A","N/A","10","10","4729","550","2025-02-18T15:35:15Z","2020-02-12T14:58:08Z"
"*/gost/releases/download/*.tar.gz*",".{0,1000}\/gost\/releases\/download\/.{0,1000}\.tar\.gz.{0,1000}","greyware_tool_keyword","gost","GO Simple Tunnel - a simple tunnel written in golang","T1572","TA0011 - TA0003","N/A","Dispossessor - EMBER BEAR","C2","https://github.com/go-gost/gost","1","1","N/A","N/A","10","10","4729","550","2025-02-18T15:35:15Z","2020-02-12T14:58:08Z"
"*/gotunnelme.git*",".{0,1000}\/gotunnelme\.git.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/NoahShen/gotunnelme","1","1","N/A","N/A","10","10","170","46","2018-01-06T04:41:15Z","2013-10-18T02:46:51Z"
"*/gt-win-x86_64.exe*",".{0,1000}\/gt\-win\-x86_64\.exe.{0,1000}","greyware_tool_keyword","gt","Fast WebSocket(s)/HTTP(s)/TCP relay proxy for making tunnels to localhost.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ao-space/gt","1","1","N/A","N/A","10","10","127","36","2024-10-30T00:37:47Z","2021-11-29T03:09:56Z"
"*/host-7.2.2.0.msi*",".{0,1000}\/host\-7\.2\.2\.0\.msi.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/hypertunnel.git*",".{0,1000}\/hypertunnel\.git.{0,1000}","greyware_tool_keyword","hypertunnel","Expose any local TCP/IP service on the internet","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/berstend/hypertunnel","1","1","N/A","N/A","10","10","246","47","2022-12-08T19:13:24Z","2018-06-11T05:29:58Z"
"*/hypertunnel-tcp-relay*.tar.gz*",".{0,1000}\/hypertunnel\-tcp\-relay.{0,1000}\.tar\.gz.{0,1000}","greyware_tool_keyword","hypertunnel","Expose any local TCP/IP service on the internet","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/berstend/hypertunnel","1","1","N/A","N/A","10","10","246","47","2022-12-08T19:13:24Z","2018-06-11T05:29:58Z"
"*/hypertunnel-tcp-relay*.zip*",".{0,1000}\/hypertunnel\-tcp\-relay.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","hypertunnel","Expose any local TCP/IP service on the internet","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/berstend/hypertunnel","1","1","N/A","N/A","10","10","246","47","2022-12-08T19:13:24Z","2018-06-11T05:29:58Z"
"*/install-fleetctl.sh*",".{0,1000}\/install\-fleetctl\.sh.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*/interactsh/*",".{0,1000}\/interactsh\/.{0,1000}","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C5","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*/interactsh-client*",".{0,1000}\/interactsh\-client.{0,1000}","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C6","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*/interactsh-collaborator*",".{0,1000}\/interactsh\-collaborator.{0,1000}","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C15","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*/interactsh-server*",".{0,1000}\/interactsh\-server.{0,1000}","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C8","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*/Invoke-Maldaptive.git*",".{0,1000}\/Invoke\-Maldaptive\.git.{0,1000}","greyware_tool_keyword","Invoke-Maldaptive","MaLDAPtive is a framework for LDAP SearchFilter parsing - obfuscation - deobfuscation and detection.","T1027","TA0005 - TA0007","N/A","N/A","Discovery","https://github.com/MaLDAPtive/Invoke-Maldaptive","1","1","N/A","N/A","7","3","261","24","2024-08-07T21:12:45Z","2024-08-07T20:43:52Z"
"*/IObitUnlocker.exe*",".{0,1000}\/IObitUnlocker\.exe.{0,1000}","greyware_tool_keyword","IObitUnlocker","unlocking locked files on Windows systems","T1222 - T1070 - T1485","TA0005 - TA0040","N/A","PLAY","Defense Evasion","https://www.iobit.com/en/iobit-unlocker.php#","1","1","N/A","often used legitimatly - admin tool","5","9","N/A","N/A","N/A","N/A"
"*/ipscan.exe*",".{0,1000}\/ipscan\.exe.{0,1000}","greyware_tool_keyword","ipscan","Angry IP Scanner - fast and friendly network scanner - abused by a lot ransomware actors","T1046 - T1040 - T1018","TA0007 - TA0009","N/A","Phobos - BERSERK BEAR","Discovery","https://github.com/angryip/ipscan","1","1","N/A","N/A","7","10","4333","743","2024-11-23T19:03:47Z","2011-06-28T20:58:48Z"
"*/ipscan.git*",".{0,1000}\/ipscan\.git.{0,1000}","greyware_tool_keyword","ipscan","Angry IP Scanner - fast and friendly network scanner - abused by a lot ransomware actors","T1046 - T1040 - T1018","TA0007 - TA0009","N/A","Phobos - BERSERK BEAR","Discovery","https://github.com/angryip/ipscan","1","1","N/A","N/A","7","10","4333","743","2024-11-23T19:03:47Z","2011-06-28T20:58:48Z"
"*/jprq.git*",".{0,1000}\/jprq\.git.{0,1000}","greyware_tool_keyword","jprq","expose TCP protocols such as HTTP - SSH etc. Any server!","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/azimjohn/jprq","1","1","N/A","N/A","10","10","1260","175","2025-01-25T10:39:59Z","2020-04-18T10:12:42Z"
"*/jprq-darwin-arm64*",".{0,1000}\/jprq\-darwin\-arm64.{0,1000}","greyware_tool_keyword","jprq","expose TCP protocols such as HTTP - SSH etc. Any server!","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/azimjohn/jprq","1","1","#linux","N/A","10","10","1260","175","2025-01-25T10:39:59Z","2020-04-18T10:12:42Z"
"*/jprq-linux-386*",".{0,1000}\/jprq\-linux\-386.{0,1000}","greyware_tool_keyword","jprq","expose TCP protocols such as HTTP - SSH etc. Any server!","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/azimjohn/jprq","1","1","#linux","N/A","10","10","1260","175","2025-01-25T10:39:59Z","2020-04-18T10:12:42Z"
"*/jprq-linux-arm64*",".{0,1000}\/jprq\-linux\-arm64.{0,1000}","greyware_tool_keyword","jprq","expose TCP protocols such as HTTP - SSH etc. Any server!","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/azimjohn/jprq","1","1","#linux","N/A","10","10","1260","175","2025-01-25T10:39:59Z","2020-04-18T10:12:42Z"
"*/jprq-windows-386.exe*",".{0,1000}\/jprq\-windows\-386\.exe.{0,1000}","greyware_tool_keyword","jprq","expose TCP protocols such as HTTP - SSH etc. Any server!","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/azimjohn/jprq","1","1","N/A","N/A","10","10","1260","175","2025-01-25T10:39:59Z","2020-04-18T10:12:42Z"
"*/jprq-windows-amd64.exe*",".{0,1000}\/jprq\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","jprq","expose TCP protocols such as HTTP - SSH etc. Any server!","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/azimjohn/jprq","1","1","N/A","N/A","10","10","1260","175","2025-01-25T10:39:59Z","2020-04-18T10:12:42Z"
"*/lansearch.exe*",".{0,1000}\/lansearch\.exe.{0,1000}","greyware_tool_keyword","advanced port scanner","port scanner tool abused by ransomware actors","T1135 - T1021 - T1016 - T1046","TA0007 - TA0043","N/A","Dispossessor - LockBit - BianLian - PYSA - Trigona - EvilCorp* - Fog - Scattered Spider* - INDRIK SPIDER - Medusa Locker","Discovery","https://www.advanced-port-scanner.com/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*/LansweeperSetup_*.exe*",".{0,1000}\/LansweeperSetup_.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Lansweeper","Lansweeper discovers and inventories IT assets - gathering system - software and user data - abused by attackers","T1016 - T1082","TA0007","N/A","EvilCorp*","Discovery","https://www.lansweeper.com/","1","1","N/A","N/A","6","7","N/A","N/A","N/A","N/A"
"*/latest/download/tunwg*",".{0,1000}\/latest\/download\/tunwg.{0,1000}","greyware_tool_keyword","tunwg","End to end encrypted secure tunnel to local servers","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ntnj/tunwg","1","1","N/A","N/A","10","10","233","9","2024-09-18T15:03:45Z","2023-01-16T17:51:13Z"
"*/level-windows-amd64.exe*",".{0,1000}\/level\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/level-windows-arm64.exe*",".{0,1000}\/level\-windows\-arm64\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/LMI_Rescue.exe*",".{0,1000}\/LMI_Rescue\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/LMIRTechConsole.exe*",".{0,1000}\/LMIRTechConsole\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/localtunnel.git*",".{0,1000}\/localtunnel\.git.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/localtunnel/localtunnel","1","1","N/A","N/A","10","10","20234","1399","2024-03-20T17:04:54Z","2012-06-18T02:33:30Z"
"*/localtunnel.git*",".{0,1000}\/localtunnel\.git.{0,1000}","greyware_tool_keyword","localtunnels","client for localtunnel.me - localtunnel exposes your localhost to the world for easy testing and sharing","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/localtunnel/localtunnel","1","1","N/A","N/A","8","10","20234","1399","2024-03-20T17:04:54Z","2012-06-18T02:33:30Z"
"*/localtunnel.js*",".{0,1000}\/localtunnel\.js.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/localtunnel/localtunnel","1","1","N/A","N/A","10","10","20234","1399","2024-03-20T17:04:54Z","2012-06-18T02:33:30Z"
"*/localtunnel-server.git*",".{0,1000}\/localtunnel\-server\.git.{0,1000}","greyware_tool_keyword","localtunnels","server for localtunnel.me - localtunnel exposes your localhost to the world for easy testing and sharing","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/localtunnel/server","1","1","N/A","N/A","8","10","3139","1022","2024-03-20T09:14:46Z","2013-06-16T22:30:48Z"
"*/loclx.exe*",".{0,1000}\/loclx\.exe.{0,1000}","greyware_tool_keyword","localxpose","LocalXpose is a reverse proxy that enables you to expose your localhost to the internet","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://localxpose.io/","1","1","N/A","N/A","10","1","N/A","N/A","N/A","N/A"
"*/loclx-windows-amd64.zip*",".{0,1000}\/loclx\-windows\-amd64\.zip.{0,1000}","greyware_tool_keyword","localxpose","LocalXpose is a reverse proxy that enables you to expose your localhost to the internet","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://localxpose.io/","1","1","N/A","N/A","10","1","N/A","N/A","N/A","N/A"
"*/lsa-whisperer-*.zip*",".{0,1000}\/lsa\-whisperer\-.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","lsa-whisperer","Tools for interacting with authentication packages using their individual message protocols","T1556.002 - T1003.001","TA0006 - TA0005","N/A","N/A","Credential Access","https://github.com/EvanMcBroom/lsa-whisperer","1","1","N/A","N/A","6","4","307","28","2025-03-01T00:12:15Z","2022-08-04T14:35:45Z"
"*/lsa-whisperer.git*",".{0,1000}\/lsa\-whisperer\.git.{0,1000}","greyware_tool_keyword","lsa-whisperer","Tools for interacting with authentication packages using their individual message protocols","T1556.002 - T1003.001","TA0006 - TA0005","N/A","N/A","Credential Access","https://github.com/EvanMcBroom/lsa-whisperer","1","1","N/A","N/A","6","4","307","28","2025-03-01T00:12:15Z","2022-08-04T14:35:45Z"
"*/LTProxy.git*",".{0,1000}\/LTProxy\.git.{0,1000}","greyware_tool_keyword","LTProxy","Linux Transparent Proxy (Similar to Proxifiter)","T1090 - T1573.001 - T1571 - T1071.001","TA0010 - TA0005","N/A","N/A","Data Exfiltration","https://github.com/L-codes/LTProxy","1","1","#linux","N/A","10","1","31","5","2024-11-27T05:09:47Z","2021-11-11T15:17:54Z"
"*/MEGAclient.exe*",".{0,1000}\/MEGAclient\.exe.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*/MEGAcmd.exe*",".{0,1000}\/MEGAcmd\.exe.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*/MEGAcmd.sh*",".{0,1000}\/MEGAcmd\.sh.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*/MEGAcmdServer.exe*",".{0,1000}\/MEGAcmdServer\.exe.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*/MEGAcmdSetup.exe*",".{0,1000}\/MEGAcmdSetup\.exe.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*/MEGAcmdSetup32.exe*",".{0,1000}\/MEGAcmdSetup32\.exe.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*/MEGAcmdSetup64.exe*",".{0,1000}\/MEGAcmdSetup64\.exe.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*/MEGAcmdSetup64.exe*",".{0,1000}\/MEGAcmdSetup64\.exe.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*/MEGAcmdShell.exe*",".{0,1000}\/MEGAcmdShell\.exe.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*/megasync.exe*",".{0,1000}\/megasync\.exe.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/MEGAsyncSetup32.exe*",".{0,1000}\/MEGAsyncSetup32\.exe.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/MEGAsyncSetup64.exe*",".{0,1000}\/MEGAsyncSetup64\.exe.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/MeshAgent.git*",".{0,1000}\/MeshAgent\.git.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","1","N/A","N/A","10","3","250","94","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*/MeshCentral.git*",".{0,1000}\/MeshCentral\.git.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*/meshinstall.sh*",".{0,1000}\/meshinstall\.sh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*/meshinstall-bsd-rcd.sh*",".{0,1000}\/meshinstall\-bsd\-rcd\.sh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*/Microsoft Azure Storage Explorer.app*",".{0,1000}\/Microsoft\sAzure\sStorage\sExplorer\.app.{0,1000}","greyware_tool_keyword","Azure Storage Explorer","legitimate microsoft software - threat actors have been abusing Azure Storage Explorer for Data Exfiltration","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Rhysida","Data Exfiltration","https://azure.microsoft.com/en-us/products/storage/storage-explorer","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*/Microsoft Azure Storage Explorer.zip*",".{0,1000}\/Microsoft\sAzure\sStorage\sExplorer\.zip.{0,1000}","greyware_tool_keyword","Azure Storage Explorer","legitimate microsoft software - threat actors have been abusing Azure Storage Explorer for Data Exfiltration","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Rhysida","Data Exfiltration","https://azure.microsoft.com/en-us/products/storage/storage-explorer","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*/MITMPluginLogViewer*",".{0,1000}\/MITMPluginLogViewer.{0,1000}","greyware_tool_keyword","yakit","security platform with fuzzers - webshell and MITM (chinese burp)","T1557 - T1557.003 - T1569.002","TA0001 - TA0040","N/A","N/A","Sniffing & Spoofing","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","7","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*/MITMServerHijacking*",".{0,1000}\/MITMServerHijacking.{0,1000}","greyware_tool_keyword","yakit","security platform with fuzzers - webshell and MITM (chinese burp)","T1557 - T1557.003 - T1569.002","TA0001 - TA0040","N/A","N/A","Sniffing & Spoofing","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","7","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*/mzcv-x64.zip*",".{0,1000}\/mzcv\-x64\.zip.{0,1000}","greyware_tool_keyword","MozillaCookiesView","nirsoft utility that displays the details of all cookies stored inside the cookies file (cookies.txt or cookies.sqlite) - abused by threat actors","T1070 - T1552.001 - T1125 - T1005","TA0009 - TA0005","N/A","MuddyWater","Credential Access","https://www.nirsoft.net/utils/mzcv.html","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*/nats-rmm.conf*",".{0,1000}\/nats\-rmm\.conf.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/neoreg.py*",".{0,1000}\/neoreg\.py.{0,1000}","greyware_tool_keyword","Neo-reGeorg","Neo-reGeorg is a project that seeks to aggressively refactor reGeorg","T1090 - T1095 - T1572","TA0003 - TA0011 - TA0005 - TA0010","N/A","IRIDIUM","Data Exfiltration","https://github.com/L-codes/Neo-reGeorg","1","1","N/A","N/A","10","10","2994","452","2025-02-18T07:26:54Z","2019-07-08T14:25:42Z"
"*/Neo-reGeorg.git*",".{0,1000}\/Neo\-reGeorg\.git.{0,1000}","greyware_tool_keyword","Neo-reGeorg","Neo-reGeorg is a project that seeks to aggressively refactor reGeorg","T1090 - T1095 - T1572","TA0003 - TA0011 - TA0005 - TA0010","N/A","IRIDIUM","Data Exfiltration","https://github.com/L-codes/Neo-reGeorg","1","1","N/A","N/A","10","10","2994","452","2025-02-18T07:26:54Z","2019-07-08T14:25:42Z"
"*/NeoreGeorg.java*",".{0,1000}\/NeoreGeorg\.java.{0,1000}","greyware_tool_keyword","Neo-reGeorg","Neo-reGeorg is a project that seeks to aggressively refactor reGeorg","T1090 - T1095 - T1572","TA0003 - TA0011 - TA0005 - TA0010","N/A","IRIDIUM","Data Exfiltration","https://github.com/L-codes/Neo-reGeorg","1","1","N/A","N/A","10","10","2994","452","2025-02-18T07:26:54Z","2019-07-08T14:25:42Z"
"*/Neo-reGeorg/tarball*",".{0,1000}\/Neo\-reGeorg\/tarball.{0,1000}","greyware_tool_keyword","Neo-reGeorg","Neo-reGeorg is a project that seeks to aggressively refactor reGeorg","T1090 - T1095 - T1572","TA0003 - TA0011 - TA0005 - TA0010","N/A","IRIDIUM","Data Exfiltration","https://github.com/L-codes/Neo-reGeorg","1","1","N/A","N/A","10","10","2994","452","2025-02-18T07:26:54Z","2019-07-08T14:25:42Z"
"*/Neo-reGeorg/zipball*",".{0,1000}\/Neo\-reGeorg\/zipball.{0,1000}","greyware_tool_keyword","Neo-reGeorg","Neo-reGeorg is a project that seeks to aggressively refactor reGeorg","T1090 - T1095 - T1572","TA0003 - TA0011 - TA0005 - TA0010","N/A","IRIDIUM","Data Exfiltration","https://github.com/L-codes/Neo-reGeorg","1","1","N/A","N/A","10","10","2994","452","2025-02-18T07:26:54Z","2019-07-08T14:25:42Z"
"*/netscan.exe*",".{0,1000}\/netscan\.exe.{0,1000}","greyware_tool_keyword","netscan","SoftPerfect Network Scanner abused by threat actor","T1040 - T1046 - T1018","TA0007 - TA0010 - TA0001","N/A","BlackSuit - Royal - Black Basta - Akira - LockBit - BianLian - Conti - BlackCat - Dagon Locker - Nokoyawa - Trigona - Hive - BlackByte - RansomHub - Cactus - Fog - Medusa - Avaddon - AvosLocker - FiveHands - Yanluowang - MONTI - DarkSide - Everest - Cicada3301 - MedusaLocker - DragonForce - Phobos - Lynx","Discovery","https://www.softperfect.com/products/networkscanner/","1","1","N/A","network exploitation tool","6","10","N/A","N/A","N/A","N/A"
"*/netscan.exe*",".{0,1000}\/netscan\.exe.{0,1000}","greyware_tool_keyword","softperfect networkscanner","SoftPerfect Network Scanner can ping computers scan ports discover shared folders and retrieve practically any information about network devices via WMI SNMP HTTP SSH and PowerShell","T1046 - T1065 - T1135 ","TA0007 ","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - LockBit - BianLian - Conti - BlackCat - Dagon Locker - Nokoyawa - Trigona - Hive - BlackByte - RansomHub - Cactus - Fog - Medusa - Avaddon - Cobalt Group - FIN7 - Anunak","Discovery","https://www.softperfect.com/products/networkscanner/","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*/netscan_linux.tar.gz*",".{0,1000}\/netscan_linux\.tar\.gz.{0,1000}","greyware_tool_keyword","softperfect networkscanner","SoftPerfect Network Scanner can ping computers scan ports discover shared folders and retrieve practically any information about network devices via WMI SNMP HTTP SSH and PowerShell","T1046 - T1065 - T1135 ","TA0007 ","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - LockBit - BianLian - Conti - BlackCat - Dagon Locker - Nokoyawa - Trigona - Hive - BlackByte - RansomHub - Cactus - Fog - Medusa - Avaddon - Cobalt Group - FIN7 - Anunak","Discovery","https://www.softperfect.com/products/networkscanner/","1","1","#linux","N/A","8","10","N/A","N/A","N/A","N/A"
"*/netscan_macos.dmg*",".{0,1000}\/netscan_macos\.dmg.{0,1000}","greyware_tool_keyword","softperfect networkscanner","SoftPerfect Network Scanner can ping computers scan ports discover shared folders and retrieve practically any information about network devices via WMI SNMP HTTP SSH and PowerShell","T1046 - T1065 - T1135 ","TA0007 ","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - LockBit - BianLian - Conti - BlackCat - Dagon Locker - Nokoyawa - Trigona - Hive - BlackByte - RansomHub - Cactus - Fog - Medusa - Avaddon - Cobalt Group - FIN7 - Anunak","Discovery","https://www.softperfect.com/products/networkscanner/","1","1","#macos","N/A","8","10","N/A","N/A","N/A","N/A"
"*/netscan_setup.exe*",".{0,1000}\/netscan_setup\.exe.{0,1000}","greyware_tool_keyword","softperfect networkscanner","SoftPerfect Network Scanner can ping computers scan ports discover shared folders and retrieve practically any information about network devices via WMI SNMP HTTP SSH and PowerShell","T1046 - T1065 - T1135 ","TA0007 ","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - LockBit - BianLian - Conti - BlackCat - Dagon Locker - Nokoyawa - Trigona - Hive - BlackByte - RansomHub - Cactus - Fog - Medusa - Avaddon - Cobalt Group - FIN7 - Anunak","Discovery","https://www.softperfect.com/products/networkscanner/","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*/netscan64.exe*",".{0,1000}\/netscan64\.exe.{0,1000}","greyware_tool_keyword","softperfect networkscanner","SoftPerfect Network Scanner can ping computers scan ports discover shared folders and retrieve practically any information about network devices via WMI SNMP HTTP SSH and PowerShell","T1046 - T1065 - T1135 ","TA0007 ","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - LockBit - BianLian - Conti - BlackCat - Dagon Locker - Nokoyawa - Trigona - Hive - BlackByte - RansomHub - Cactus - Fog - Medusa - Avaddon - Cobalt Group - FIN7 - Anunak","Discovery","https://www.softperfect.com/products/networkscanner/","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*/netshrun.c*",".{0,1000}\/netshrun\.c.{0,1000}","greyware_tool_keyword","NetshRun","Netsh.exe relies on extensions taken from Registry which means it may be used as a persistence and you go one step further extending netsh with a DLL allowing you to do whatever you want","T1546.008 - T1112 - T1037 - T1055 - T1218.001","TA0003 - TA0002 - TA0008","N/A","N/A","Exploitation tool","https://github.com/gtworek/PSBits/blob/master/NetShRun","1","1","N/A","N/A","N/A","10","3304","542","2025-01-21T05:52:54Z","2019-06-29T13:22:36Z"
"*/ngrok.git*",".{0,1000}\/ngrok\.git.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","N/A","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*/ngrok.go*",".{0,1000}\/ngrok\.go.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","N/A","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*/ngrokd.go*",".{0,1000}\/ngrokd\.go.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","N/A","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*/NimScan.exe*",".{0,1000}\/NimScan\.exe.{0,1000}","greyware_tool_keyword","NimScan","Really fast port scanner (With filtered option - Windows support only)","T1046","TA0007","N/A","N/A","Discovery","https://github.com/elddy/NimScan","1","1","N/A","N/A","8","4","389","38","2022-02-10T13:23:02Z","2020-08-12T14:20:46Z"
"*/NimScan.git*",".{0,1000}\/NimScan\.git.{0,1000}","greyware_tool_keyword","NimScan","Really fast port scanner (With filtered option - Windows support only)","T1046","TA0007","N/A","N/A","Discovery","https://github.com/elddy/NimScan","1","1","N/A","N/A","8","4","389","38","2022-02-10T13:23:02Z","2020-08-12T14:20:46Z"
"*/NimScan.nim*",".{0,1000}\/NimScan\.nim.{0,1000}","greyware_tool_keyword","NimScan","Really fast port scanner (With filtered option - Windows support only)","T1046","TA0007","N/A","N/A","Discovery","https://github.com/elddy/NimScan","1","1","N/A","N/A","8","4","389","38","2022-02-10T13:23:02Z","2020-08-12T14:20:46Z"
"*/nircmd.exe*",".{0,1000}\/nircmd\.exe.{0,1000}","greyware_tool_keyword","nircmd","Nirsoft tool - NirCmd is a small command-line utility that allows you to do some useful tasks without displaying any user interface","T1059 - T1036","TA0005 - TA0002 - TA0003","N/A","N/A","Defense Evasion","https://www.nirsoft.net/utils/nircmd.html","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/nircmd.zip*",".{0,1000}\/nircmd\.zip.{0,1000}","greyware_tool_keyword","nircmd","Nirsoft tool - NirCmd is a small command-line utility that allows you to do some useful tasks without displaying any user interface","T1059 - T1036","TA0005 - TA0002 - TA0003","N/A","N/A","Defense Evasion","https://www.nirsoft.net/utils/nircmd.html","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/nircmdc.exe*",".{0,1000}\/nircmdc\.exe.{0,1000}","greyware_tool_keyword","nircmd","Nirsoft tool - NirCmd is a small command-line utility that allows you to do some useful tasks without displaying any user interface","T1059 - T1036","TA0005 - TA0002 - TA0003","N/A","N/A","Defense Evasion","https://www.nirsoft.net/utils/nircmd.html","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/nircmd-x64.zip*",".{0,1000}\/nircmd\-x64\.zip.{0,1000}","greyware_tool_keyword","nircmd","Nirsoft tool - NirCmd is a small command-line utility that allows you to do some useful tasks without displaying any user interface","T1059 - T1036","TA0005 - TA0002 - TA0003","N/A","N/A","Defense Evasion","https://www.nirsoft.net/utils/nircmd.html","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Nmap/folder/check15*",".{0,1000}\/Nmap\/folder\/check15.{0,1000}","greyware_tool_keyword","nmap","Nmap (Network Mapper) is a free and open source utility for network discovery and security auditing","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Discovery","https://github.com/nmap/nmap/blob/635675b1430a89e950f71112d3bfc74feee4b19a/nselib/http.lua#L2600","1","1","N/A","will appear on your server access logs if you are scanned by nmap","8","10","10695","2466","2025-02-27T16:45:09Z","2012-03-09T14:47:43Z"
"*/Nmap/folder/check16*",".{0,1000}\/Nmap\/folder\/check16.{0,1000}","greyware_tool_keyword","nmap","Nmap (Network Mapper) is a free and open source utility for network discovery and security auditing","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Discovery","https://github.com/nmap/nmap/blob/635675b1430a89e950f71112d3bfc74feee4b19a/nselib/http.lua#L2600","1","1","N/A","will appear on your server access logs if you are scanned by nmap","8","10","10695","2466","2025-02-27T16:45:09Z","2012-03-09T14:47:43Z"
"*/Nmap/folder/check17*",".{0,1000}\/Nmap\/folder\/check17.{0,1000}","greyware_tool_keyword","nmap","Nmap (Network Mapper) is a free and open source utility for network discovery and security auditing","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Discovery","https://github.com/nmap/nmap/blob/635675b1430a89e950f71112d3bfc74feee4b19a/nselib/http.lua#L2600","1","1","N/A","will appear on your server access logs if you are scanned by nmap","8","10","10695","2466","2025-02-27T16:45:09Z","2012-03-09T14:47:43Z"
"*/nmaplowercheck15*",".{0,1000}\/nmaplowercheck15.{0,1000}","greyware_tool_keyword","nmap","Nmap (Network Mapper) is a free and open source utility for network discovery and security auditing","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Discovery","https://nmap.org/book/nse-usage.html","1","1","N/A","will appear on your server access logs if you are scanned by nmap","8","10","N/A","N/A","N/A","N/A"
"*/nmaplowercheck16*",".{0,1000}\/nmaplowercheck16.{0,1000}","greyware_tool_keyword","nmap","Nmap (Network Mapper) is a free and open source utility for network discovery and security auditing","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Discovery","https://github.com/nmap/nmap/blob/635675b1430a89e950f71112d3bfc74feee4b19a/nselib/http.lua#L2600","1","1","N/A","will appear on your server access logs if you are scanned by nmap","8","10","10695","2466","2025-02-27T16:45:09Z","2012-03-09T14:47:43Z"
"*/nmaplowercheck17*",".{0,1000}\/nmaplowercheck17.{0,1000}","greyware_tool_keyword","nmap","Nmap (Network Mapper) is a free and open source utility for network discovery and security auditing","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Discovery","https://github.com/nmap/nmap/blob/635675b1430a89e950f71112d3bfc74feee4b19a/nselib/http.lua#L2600","1","1","N/A","will appear on your server access logs if you are scanned by nmap","8","10","10695","2466","2025-02-27T16:45:09Z","2012-03-09T14:47:43Z"
"*/nmap-scada*",".{0,1000}\/nmap\-scada.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*/NmapUpperCheck15*",".{0,1000}\/NmapUpperCheck15.{0,1000}","greyware_tool_keyword","nmap","Nmap (Network Mapper) is a free and open source utility for network discovery and security auditing","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Discovery","https://github.com/nmap/nmap/blob/635675b1430a89e950f71112d3bfc74feee4b19a/nselib/http.lua#L2600","1","1","N/A","will appear on your server access logs if you are scanned by nmap","8","10","10695","2466","2025-02-27T16:45:09Z","2012-03-09T14:47:43Z"
"*/NmapUpperCheck16*",".{0,1000}\/NmapUpperCheck16.{0,1000}","greyware_tool_keyword","nmap","Nmap (Network Mapper) is a free and open source utility for network discovery and security auditing","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Discovery","https://github.com/nmap/nmap/blob/635675b1430a89e950f71112d3bfc74feee4b19a/nselib/http.lua#L2600","1","1","N/A","will appear on your server access logs if you are scanned by nmap","8","10","10695","2466","2025-02-27T16:45:09Z","2012-03-09T14:47:43Z"
"*/NmapUpperCheck17*",".{0,1000}\/NmapUpperCheck17.{0,1000}","greyware_tool_keyword","nmap","Nmap (Network Mapper) is a free and open source utility for network discovery and security auditing","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Discovery","https://github.com/nmap/nmap/blob/635675b1430a89e950f71112d3bfc74feee4b19a/nselib/http.lua#L2600","1","1","N/A","will appear on your server access logs if you are scanned by nmap","8","10","10695","2466","2025-02-27T16:45:09Z","2012-03-09T14:47:43Z"
"*/nmap-vulners*",".{0,1000}\/nmap\-vulners.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*/nse-install.git*",".{0,1000}\/nse\-install\.git.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*/nspowershell.exe*",".{0,1000}\/nspowershell\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/nssadmui.exe*",".{0,1000}\/nssadmui\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/OfflineSamTool.exe*",".{0,1000}\/OfflineSamTool\.exe.{0,1000}","greyware_tool_keyword","oset","Offline SAM Editor Tool to  access and edit SAM databases from offline OS disk","T1078 - T1003.002 - T1547.001","TA0003 - TA0006 - TA0007 - TA0005","N/A","N/A","Credential Access","https://x.com/0gtweet/status/1817859483445461406","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/openvpn.exe*",".{0,1000}\/openvpn\.exe.{0,1000}","greyware_tool_keyword","OPENVPN","OpenVPN is a legitimate tool that might be used by an adversary to maintain persistence or exfiltrate data","T1071  - T1573 - T1133","TA0003 - TA0008 - TA0011","N/A","N/A","Defense Evasion","https://openvpn.net/","1","1","#VPN","N/A","6","8","N/A","N/A","N/A","N/A"
"*/oset.exe*",".{0,1000}\/oset\.exe.{0,1000}","greyware_tool_keyword","oset","Offline SAM Editor Tool to  access and edit SAM databases from offline OS disk","T1078 - T1003.002 - T1547.001","TA0003 - TA0006 - TA0007 - TA0005","N/A","N/A","Credential Access","https://x.com/0gtweet/status/1817859483445461406","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/oset.zip*",".{0,1000}\/oset\.zip.{0,1000}","greyware_tool_keyword","oset","Offline SAM Editor Tool to  access and edit SAM databases from offline OS disk","T1078 - T1003.002 - T1547.001","TA0003 - TA0006 - TA0007 - TA0005","N/A","N/A","Credential Access","https://x.com/0gtweet/status/1817859483445461406","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/OshiUpload.git*",".{0,1000}\/OshiUpload\.git.{0,1000}","greyware_tool_keyword","OshiUpload","Ephemeral file sharing engine","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Black Basta","Data Exfiltration","https://github.com/somenonymous/OshiUpload","1","1","#filehostingservice #P2P","N/A","10","2","188","26","2022-10-01T04:08:29Z","2019-05-11T02:08:51Z"
"*/PAExec.cpp*",".{0,1000}\/PAExec\.cpp.{0,1000}","greyware_tool_keyword","PAExec","PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program","T1047 - T1105 - T1204","TA0003 - TA0008 - TA0040","N/A","N/A","Lateral Movement","https://github.com/poweradminllc/PAExec","1","1","N/A","N/A","10","6","551","178","2025-02-21T15:14:44Z","2013-11-13T04:05:27Z"
"*/paexec.exe",".{0,1000}\/paexec\.exe","greyware_tool_keyword","PAExec","PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program","T1047 - T1105 - T1204","TA0003 - TA0008 - TA0040","N/A","N/A","Lateral Movement","https://github.com/poweradminllc/PAExec","1","1","N/A","N/A","10","6","551","178","2025-02-21T15:14:44Z","2013-11-13T04:05:27Z"
"*/PAExec.git*",".{0,1000}\/PAExec\.git.{0,1000}","greyware_tool_keyword","PAExec","PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program","T1047 - T1105 - T1204","TA0003 - TA0008 - TA0040","N/A","N/A","Lateral Movement","https://github.com/poweradminllc/PAExec","1","1","N/A","N/A","10","6","551","178","2025-02-21T15:14:44Z","2013-11-13T04:05:27Z"
"*/pagekite.py*",".{0,1000}\/pagekite\.py.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*/pagekite-0.3.21.py*",".{0,1000}\/pagekite\-0\.3\.21\.py.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*/pagekite-0.4.6a.py*",".{0,1000}\/pagekite\-0\.4\.6a\.py.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*/pagekite-0.5.6d.py*",".{0,1000}\/pagekite\-0\.5\.6d\.py.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*/pagekite-0.5.8a.py*",".{0,1000}\/pagekite\-0\.5\.8a\.py.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*/pagekite-gtk.py*",".{0,1000}\/pagekite\-gtk\.py.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*/PCHunter.exe*",".{0,1000}\/PCHunter\.exe.{0,1000}","greyware_tool_keyword","PCHunter","PCHunter is a toolkit offering deep access to kernel setting - processes - network  and startup configurations. It is designed to detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","LockBit - Conti - 8BASE - TargetCompany - Hive - Qilin","Defense Evasion","https://www.majorgeeks.com/files/details/pc_hunter.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*/PCHunter_free.zip*",".{0,1000}\/PCHunter_free\.zip.{0,1000}","greyware_tool_keyword","PCHunter","PCHunter is a toolkit offering deep access to kernel setting - processes - network  and startup configurations. It is designed to detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","LockBit - Conti - 8BASE - TargetCompany - Hive - Qilin","Defense Evasion","https://www.majorgeeks.com/files/details/pc_hunter.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*/PCMonitorManager.exe*",".{0,1000}\/PCMonitorManager\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/PCMonitorSrv.exe*",".{0,1000}\/PCMonitorSrv\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pcmontask.exe*",".{0,1000}\/pcmontask\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pcmrdp-client.dll*",".{0,1000}\/pcmrdp\-client\.dll.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pcunlocker.iso*",".{0,1000}\/pcunlocker\.iso.{0,1000}","greyware_tool_keyword","pcunlocker","Reset and unlock forgotten Windows login password","T1078","TA0005 - TA0006 - TA0009","N/A","N/A","Credential Access","https://www.pcunlocker.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pcunlocker_trial.zip*",".{0,1000}\/pcunlocker_trial\.zip.{0,1000}","greyware_tool_keyword","pcunlocker","Reset and unlock forgotten Windows login password","T1078","TA0005 - TA0006 - TA0009","N/A","N/A","Credential Access","https://www.pcunlocker.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pgrok.exe*",".{0,1000}\/pgrok\.exe.{0,1000}","greyware_tool_keyword","pgrok","Poor man's ngrok - a multi-tenant HTTP/TCP reverse tunnel solution through SSH remote port forwarding","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/jerson/pgrok","1","1","N/A","N/A","10","10","283","55","2022-05-30T14:53:46Z","2019-07-31T13:23:51Z"
"*/pgrok.git*",".{0,1000}\/pgrok\.git.{0,1000}","greyware_tool_keyword","pgrok","Poor man's ngrok - a multi-tenant HTTP/TCP reverse tunnel solution through SSH remote port forwarding","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pgrok/pgrok","1","1","N/A","N/A","10","10","3263","112","2025-03-01T08:52:06Z","2023-03-08T12:43:55Z"
"*/pgrokd.exe*",".{0,1000}\/pgrokd\.exe.{0,1000}","greyware_tool_keyword","pgrok","Poor man's ngrok - a multi-tenant HTTP/TCP reverse tunnel solution through SSH remote port forwarding","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/jerson/pgrok","1","1","N/A","N/A","10","10","283","55","2022-05-30T14:53:46Z","2019-07-31T13:23:51Z"
"*/pgrokd_*.zip*",".{0,1000}\/pgrokd_.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","pgrok","Poor man's ngrok - a multi-tenant HTTP/TCP reverse tunnel solution through SSH remote port forwarding","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pgrok/pgrok","1","1","N/A","N/A","10","10","3263","112","2025-03-01T08:52:06Z","2023-03-08T12:43:55Z"
"*/pingcastle.git*",".{0,1000}\/pingcastle\.git.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://github.com/netwrix/pingcastle","1","1","N/A","N/A","10","10","2452","303","2025-02-28T10:16:24Z","2018-08-31T17:42:48Z"
"*/PingCastle.zip*",".{0,1000}\/PingCastle\.zip.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://github.com/netwrix/pingcastle","1","1","N/A","N/A","10","10","2452","303","2025-02-28T10:16:24Z","2018-08-31T17:42:48Z"
"*/pingcastle/releases/download/*",".{0,1000}\/pingcastle\/releases\/download\/.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://github.com/netwrix/pingcastle","1","1","N/A","N/A","10","10","2452","303","2025-02-28T10:16:24Z","2018-08-31T17:42:48Z"
"*/PortQry.exe*",".{0,1000}\/PortQry\.exe.{0,1000}","greyware_tool_keyword","PortQry","Microsoft port scanning tool abused by threat actors","T1046 - T1016 - T1049","TA0007","N/A","APT15","Discovery","https://www.microsoft.com/en-us/download/details.aspx?id=17148","1","1","N/A","N/A","6","7","N/A","N/A","N/A","N/A"
"*/PortQryV2.exe*",".{0,1000}\/PortQryV2\.exe.{0,1000}","greyware_tool_keyword","PortQry","Microsoft port scanning tool abused by threat actors","T1046 - T1016 - T1049","TA0007","N/A","APT15","Discovery","https://www.microsoft.com/en-us/download/details.aspx?id=17148","1","1","N/A","N/A","6","7","N/A","N/A","N/A","N/A"
"*/portr.exe*",".{0,1000}\/portr\.exe.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/portr.git*",".{0,1000}\/portr\.git.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/portr/releases*",".{0,1000}\/portr\/releases.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/portr_*_Darwin_arm64.zip*",".{0,1000}\/portr_.{0,1000}_Darwin_arm64\.zip.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","#linux","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/portr_*_Darwin_x86_64.zip*",".{0,1000}\/portr_.{0,1000}_Darwin_x86_64\.zip.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","#linux","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/portr_*_Linux_arm64.zip*",".{0,1000}\/portr_.{0,1000}_Linux_arm64\.zip.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","#linux","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/portr_*_Linux_x86_64.zip*",".{0,1000}\/portr_.{0,1000}_Linux_x86_64\.zip.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","#linux","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/portr_*_Windows_arm64.zip*",".{0,1000}\/portr_.{0,1000}_Windows_arm64\.zip.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/portr_*_Windows_x86_64.zip*",".{0,1000}\/portr_.{0,1000}_Windows_x86_64\.zip.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/portr_admin/*.py*",".{0,1000}\/portr_admin\/.{0,1000}\.py.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*/privoxy.exe*",".{0,1000}\/privoxy\.exe.{0,1000}","greyware_tool_keyword","shadowsocks","shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-windows","1","1","N/A","N/A","10","10","58635","16369","2025-01-01T08:09:55Z","2013-01-14T07:54:16Z"
"*/Procdump.zip*",".{0,1000}\/Procdump\.zip.{0,1000}","greyware_tool_keyword","Procdump","dump lsass process with procdump","T1003.001","TA0006","N/A","LockBit - Kimsuky - Conti - Quantum - PYSA - NetWalker - 8BASE - APT1 - APT15 - APT20 - APT27 - APT28 - Antlion - FIN13 - GOBLIN PANDA - Lazarus Group - PowerPool - PARINACOTA - Scattered Spider - BERSERK BEAR - Dispossessor","Credential Access","https://learn.microsoft.com/en-us/sysinternals/downloads/procdump","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/processhacker-*-bin.zip*",".{0,1000}\/processhacker\-.{0,1000}\-bin\.zip.{0,1000}","greyware_tool_keyword","processhacker","Interactions with a objects present in windows such as threads stack - handles - gpu - services ? can be used by attackers to dump process - create services  and process injection","T1055.001 - T1055.012 - T1003.001 - T1056.005","TA0005 - TA0003 - TA0040 - TA0006 - TA0009","N/A","N/A","Persistence","https://processhacker.sourceforge.io/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*/processhacker/files/latest/download*",".{0,1000}\/processhacker\/files\/latest\/download.{0,1000}","greyware_tool_keyword","processhacker","Interactions with a objects present in windows such as threads stack - handles - gpu - services ? can be used by attackers to dump process - create services  and process injection","T1055.001 - T1055.012 - T1003.001 - T1056.005","TA0005 - TA0003 - TA0040 - TA0006 - TA0009","N/A","N/A","Persistence","https://processhacker.sourceforge.io/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*/ProduKey.exe*",".{0,1000}\/ProduKey\.exe.{0,1000}","greyware_tool_keyword","produkey","ProduKey is a small utility that displays the ProductID and the CD-Key of Microsoft Office (Microsoft Office 2003. Microsoft Office 2007). Windows (Including Windows 8/7/Vista). Exchange Server. and SQL Server installed on your computer. You can view this information for your current running operating system. or for another operating system/computer - by using command-line options. This utility can be useful if you lost the product key of your Windows/Office. and you want to reinstall it on your computer.","T1003.001 - T1003.002 - T1012 - T1057 - T1518","TA0006 - TA0007 - TA0009","N/A","Evilnum","Credential Access","https://www.nirsoft.net/utils/product_cd_key_viewer.html","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*/Proxifier.exe*",".{0,1000}\/Proxifier\.exe.{0,1000}","greyware_tool_keyword","Proxifier","allows to proxy connections for programs","T1090 - T1071 - T1078.003","TA0005","N/A","Scattered Spider* - Proxifier","Defense Evasion","https://www.proxifier.com/download/","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*/ProxifierPE.zip*",".{0,1000}\/ProxifierPE\.zip.{0,1000}","greyware_tool_keyword","Proxifier","allows to proxy connections for programs","T1090 - T1071 - T1078.003","TA0005","N/A","Scattered Spider* - Proxifier","Defense Evasion","https://www.proxifier.com/download/","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*/ProxifierSetup.exe*",".{0,1000}\/ProxifierSetup\.exe.{0,1000}","greyware_tool_keyword","Proxifier","allows to proxy connections for programs","T1090 - T1071 - T1078.003","TA0005","N/A","Scattered Spider* - Proxifier","Defense Evasion","https://www.proxifier.com/download/","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*/ps2exe.ps1*",".{0,1000}\/ps2exe\.ps1.{0,1000}","greyware_tool_keyword","redpill","Assist reverse tcp shells in post-exploration tasks","T1082 - T1016 - T1049 - T1057 - T1489 - T1070 - T1562 - T1563 - T1119 - T1518 - T1602 - T1530 - T1113 - T1125 - T1105 - T1133 - T1056 - T1114 - T1539 - T1552 - T1214 - T1110 - T1040 - T1436 - T1068 - T1088 - T1564 - T1112 - T1547 - T1574 - T1204 - T1215 - T1046 - T1557 - T1136 - T1059 - T1127 - T1555 - T1548 - T1115 - T1003","TA0007 - TA0003 - TA0005 - TA0009 - TA0002 - TA0006 - TA0004 - TA0010 - TA0011","N/A","N/A","Exploitation tool","https://github.com/r00t-3xp10it/redpill","1","1","N/A","N/A","10","3","216","52","2024-03-19T15:03:16Z","2021-02-20T23:59:07Z"
"*/pslist.exe*",".{0,1000}\/pslist\.exe.{0,1000}","greyware_tool_keyword","pslist","Microsoft sysinternal comandline tool to list running process abused by threat actors","T1057 - T1012 - T1106","TA0007","N/A","APT10 - APT15 - APT33 - APT34 - Sandworm - APT35 - CHRYSENE - menuPass - GhostEmperor - Magnallium - Elfin","Discovery","https://learn.microsoft.com/pt-br/sysinternals/downloads/pslist","1","1","N/A","N/A","3","9","N/A","N/A","N/A","N/A"
"*/pslist64.exe*",".{0,1000}\/pslist64\.exe.{0,1000}","greyware_tool_keyword","pslist","Microsoft sysinternal comandline tool to list running process abused by threat actors","T1057 - T1012 - T1106","TA0007","N/A","APT10 - APT15 - APT33 - APT34 - Sandworm - APT35 - CHRYSENE - menuPass - GhostEmperor - Magnallium - Elfin","Discovery","https://learn.microsoft.com/pt-br/sysinternals/downloads/pslist","1","1","N/A","N/A","3","9","N/A","N/A","N/A","N/A"
"*/pulseway_x64.deb*",".{0,1000}\/pulseway_x64\.deb.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Pulseway_x64.msi*",".{0,1000}\/Pulseway_x64\.msi.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pulseway_x86.deb*",".{0,1000}\/pulseway_x86\.deb.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/py2exe/*",".{0,1000}\/py2exe\/.{0,1000}","greyware_tool_keyword","py2exe","py2exe allows you to convert Python scripts into standalone executable files for Windows othen used by attacker","T1027.002 - T1045 - T1059.001 - T1587.001","TA0005 - TA0042","Operation Wocao","N/A","Resource Development","https://github.com/py2exe/py2exe","1","1","N/A","greyware_tools high risks of false positives","N/A","10","914","102","2024-11-12T19:44:34Z","2019-03-11T13:16:35Z"
"*/pyjam.as/tunnel*",".{0,1000}\/pyjam\.as\/tunnel.{0,1000}","greyware_tool_keyword","tunnel","SSL-terminated ephemeral HTTP tunnels to your local machine","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://gitlab.com/pyjam.as/tunnel","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/PyPagekite.git*",".{0,1000}\/PyPagekite\.git.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*/PyPagekite/tarball/*",".{0,1000}\/PyPagekite\/tarball\/.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*/PyPagekite/zipball/*",".{0,1000}\/PyPagekite\/zipball\/.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*/pyshark.git*",".{0,1000}\/pyshark\.git.{0,1000}","greyware_tool_keyword","pyshark","Python wrapper for tshark allowing python packet parsing using wireshark dissectors","T1040 - T1213 - T1105 - T1572","TA0009 - TA0007","N/A","N/A","Discovery","https://github.com/KimiNewt/pyshark","1","1","N/A","N/A","6","10","2332","435","2024-12-04T15:41:20Z","2013-12-28T14:38:22Z"
"*/QNAP_NAS/megacmdpkg*",".{0,1000}\/QNAP_NAS\/megacmdpkg.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*/Quasar.git*",".{0,1000}\/Quasar\.git.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","9032","2528","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*/Quasar.v*.zip*",".{0,1000}\/Quasar\.v.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","9032","2528","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*/Quasar/releases*",".{0,1000}\/Quasar\/releases.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","9032","2528","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*/Quick Assist Installer.exe*",".{0,1000}\/Quick\sAssist\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*/Quick%20Assist%20Installer.exe*",".{0,1000}\/Quick\%20Assist\%20Installer\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*/Radmin.exe*",".{0,1000}\/Radmin\.exe.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Radmin_Server_*.msi*",".{0,1000}\/Radmin_Server_.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Radmin_Viewer_*.msi*",".{0,1000}\/Radmin_Viewer_.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Radmin_VPN_1.*.exe*",".{0,1000}\/Radmin_VPN_1\..{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rathole.exe",".{0,1000}\/rathole\.exe","greyware_tool_keyword","rathole"," expose the service on the device behind the NAT to the Internet, via a server with a public IP.","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/rapiz1/rathole","1","1","N/A","N/A","10","10","10394","532","2024-07-06T20:09:48Z","2021-12-14T05:03:07Z"
"*/rathole.git*",".{0,1000}\/rathole\.git.{0,1000}","greyware_tool_keyword","rathole"," expose the service on the device behind the NAT to the Internet, via a server with a public IP.","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/rapiz1/rathole","1","1","N/A","N/A","10","10","10394","532","2024-07-06T20:09:48Z","2021-12-14T05:03:07Z"
"*/rathole/src/*",".{0,1000}\/rathole\/src\/.{0,1000}","greyware_tool_keyword","rathole"," expose the service on the device behind the NAT to the Internet, via a server with a public IP.","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/rapiz1/rathole","1","1","N/A","N/A","10","10","10394","532","2024-07-06T20:09:48Z","2021-12-14T05:03:07Z"
"*/rathole-aarch64-*",".{0,1000}\/rathole\-aarch64\-.{0,1000}","greyware_tool_keyword","rathole"," expose the service on the device behind the NAT to the Internet, via a server with a public IP.","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/rapiz1/rathole","1","1","N/A","N/A","10","10","10394","532","2024-07-06T20:09:48Z","2021-12-14T05:03:07Z"
"*/rathole-arm*",".{0,1000}\/rathole\-arm.{0,1000}","greyware_tool_keyword","rathole"," expose the service on the device behind the NAT to the Internet, via a server with a public IP.","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/rapiz1/rathole","1","1","N/A","N/A","10","10","10394","532","2024-07-06T20:09:48Z","2021-12-14T05:03:07Z"
"*/rathole-main/*",".{0,1000}\/rathole\-main\/.{0,1000}","greyware_tool_keyword","rathole"," expose the service on the device behind the NAT to the Internet, via a server with a public IP.","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/rapiz1/rathole","1","1","N/A","N/A","10","10","10394","532","2024-07-06T20:09:48Z","2021-12-14T05:03:07Z"
"*/rathole-mipsel-*",".{0,1000}\/rathole\-mipsel\-.{0,1000}","greyware_tool_keyword","rathole"," expose the service on the device behind the NAT to the Internet, via a server with a public IP.","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/rapiz1/rathole","1","1","N/A","N/A","10","10","10394","532","2024-07-06T20:09:48Z","2021-12-14T05:03:07Z"
"*/rathole-x86_64*",".{0,1000}\/rathole\-x86_64.{0,1000}","greyware_tool_keyword","rathole"," expose the service on the device behind the NAT to the Internet, via a server with a public IP.","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/rapiz1/rathole","1","1","N/A","N/A","10","10","10394","532","2024-07-06T20:09:48Z","2021-12-14T05:03:07Z"
"*/raw/main/speedtest.exe*",".{0,1000}\/raw\/main\/speedtest\.exe.{0,1000}","greyware_tool_keyword","speedtest","legitimate tool from speedtest.net abused by threat actors to assess the network speed and determine the feasibility and duration of their exfiltration efforts","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","","Dispossessor - Dagon Locker","Data Exfiltration","https://vx-underground.org/Archive/Dispossessor%20Leaks","1","1","N/A","N/A","6","7","N/A","N/A","N/A","N/A"
"*/raw/master/speedtest.exe*",".{0,1000}\/raw\/master\/speedtest\.exe.{0,1000}","greyware_tool_keyword","speedtest","legitimate tool from speedtest.net abused by threat actors to assess the network speed and determine the feasibility and duration of their exfiltration efforts","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","","Dispossessor - Dagon Locker","Data Exfiltration","https://vx-underground.org/Archive/Dispossessor%20Leaks","1","1","N/A","N/A","6","7","N/A","N/A","N/A","N/A"
"*/rclone.git*",".{0,1000}\/rclone\.git.{0,1000}","greyware_tool_keyword","rclone","Rclone is a command line program for syncing files with cloud storage services - abused by a lot of ransomware groups","T1567.002 - T1560.001 - T1030 - T1048.002 - T1048.003 - T1567.002 - T1083","TA0010","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - Karakurt - AvosLocker - LockBit - BianLian - Hive - Daixin - Conti - Dagon Locker - Trigona - Quantum - Revil - 8BASE - INC Ransom - Cactus - EvilCorp* - Scattered Spider* - FiveHands - Cinnamon Tempest - EMBER BEA - Gamaredon","Data Exfiltration","https://github.com/rclone/rclone","1","1","N/A","N/A","8","10","49104","4366","2025-02-28T12:22:51Z","2014-03-16T16:19:57Z"
"*/rclone.rar*",".{0,1000}\/rclone\.rar.{0,1000}","greyware_tool_keyword","rclone","Rclone is a command line program for syncing files with cloud storage services - abused by a lot of ransomware groups","T1567.002 - T1560.001 - T1030 - T1048.002 - T1048.003 - T1567.002 - T1083","TA0010","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - Karakurt - AvosLocker - LockBit - BianLian - Hive - Daixin - Conti - Dagon Locker - Trigona - Quantum - Revil - 8BASE - INC Ransom - Cactus - EvilCorp* - Scattered Spider* - FiveHands - Cinnamon Tempest - EMBER BEA - Gamaredon","Data Exfiltration","https://github.com/rclone/rclone","1","1","N/A","N/A","8","10","49104","4366","2025-02-28T12:22:51Z","2014-03-16T16:19:57Z"
"*/rclone.zip*",".{0,1000}\/rclone\.zip.{0,1000}","greyware_tool_keyword","rclone","Rclone is a command line program for syncing files with cloud storage services - abused by a lot of ransomware groups","T1567.002 - T1560.001 - T1030 - T1048.002 - T1048.003 - T1567.002 - T1083","TA0010","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - Karakurt - AvosLocker - LockBit - BianLian - Hive - Daixin - Conti - Dagon Locker - Trigona - Quantum - Revil - 8BASE - INC Ransom - Cactus - EvilCorp* - Scattered Spider* - FiveHands - Cinnamon Tempest - EMBER BEA - Gamaredon","Data Exfiltration","https://github.com/rclone/rclone","1","1","N/A","N/A","8","10","49104","4366","2025-02-28T12:22:51Z","2014-03-16T16:19:57Z"
"*/rclone/releases/download/*",".{0,1000}\/rclone\/releases\/download\/.{0,1000}","greyware_tool_keyword","rclone","Rclone is a command line program for syncing files with cloud storage services - abused by a lot of ransomware groups","T1567.002 - T1560.001 - T1030 - T1048.002 - T1048.003 - T1567.002 - T1083","TA0010","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - Karakurt - AvosLocker - LockBit - BianLian - Hive - Daixin - Conti - Dagon Locker - Trigona - Quantum - Revil - 8BASE - INC Ransom - Cactus - EvilCorp* - Scattered Spider* - FiveHands - Cinnamon Tempest - EMBER BEA - Gamaredon","Data Exfiltration","https://github.com/rclone/rclone","1","1","N/A","N/A","8","10","49104","4366","2025-02-28T12:22:51Z","2014-03-16T16:19:57Z"
"*/rdpscan.git*",".{0,1000}\/rdpscan\.git.{0,1000}","greyware_tool_keyword","rdpscan","A quick scanner for the CVE-2019-0708 ""BlueKeep"" vulnerability","T1210 - T1046","TA0001 - TA0008","N/A","Dispossessor","Discovery","https://github.com/robertdavidgraham/rdpscan","1","1","N/A","N/A","6","10","904","243","2019-06-22T21:48:45Z","2019-05-23T22:50:12Z"
"*/rdpscan-macos.zip*",".{0,1000}\/rdpscan\-macos\.zip.{0,1000}","greyware_tool_keyword","rdpscan","A quick scanner for the CVE-2019-0708 ""BlueKeep"" vulnerability","T1210 - T1046","TA0001 - TA0008","N/A","Dispossessor","Discovery","https://github.com/robertdavidgraham/rdpscan","1","1","N/A","N/A","6","10","904","243","2019-06-22T21:48:45Z","2019-05-23T22:50:12Z"
"*/rdpscan-windows.zip*",".{0,1000}\/rdpscan\-windows\.zip.{0,1000}","greyware_tool_keyword","rdpscan","A quick scanner for the CVE-2019-0708 ""BlueKeep"" vulnerability","T1210 - T1046","TA0001 - TA0008","N/A","Dispossessor","Discovery","https://github.com/robertdavidgraham/rdpscan","1","1","N/A","N/A","6","10","904","243","2019-06-22T21:48:45Z","2019-05-23T22:50:12Z"
"*/RDPWInst.exe*",".{0,1000}\/RDPWInst\.exe.{0,1000}","greyware_tool_keyword","rdpwrap","RDP Wrapper Library used by malwares","T1021","TA0008","N/A","N/A","Lateral Movement","https://github.com/stascorp/rdpwrap","1","1","N/A","N/A","10","10","15129","3891","2024-06-18T15:08:33Z","2014-10-22T23:18:28Z"
"*/RDPWInst-v*.msi*",".{0,1000}\/RDPWInst\-v.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","rdpwrap","RDP Wrapper Library used by malwares","T1021","TA0008","N/A","N/A","Lateral Movement","https://github.com/stascorp/rdpwrap","1","1","N/A","N/A","10","10","15129","3891","2024-06-18T15:08:33Z","2014-10-22T23:18:28Z"
"*/rdpwrap.dll*",".{0,1000}\/rdpwrap\.dll.{0,1000}","greyware_tool_keyword","rdpwrap","RDP Wrapper Library used by malwares","T1021","TA0008","N/A","N/A","Lateral Movement","https://github.com/stascorp/rdpwrap","1","1","N/A","N/A","10","10","15129","3891","2024-06-18T15:08:33Z","2014-10-22T23:18:28Z"
"*/rdpwrap.git*",".{0,1000}\/rdpwrap\.git.{0,1000}","greyware_tool_keyword","rdpwrap","RDP Wrapper Library used by malwares","T1021","TA0008","N/A","N/A","Lateral Movement","https://github.com/stascorp/rdpwrap","1","1","N/A","N/A","10","10","15129","3891","2024-06-18T15:08:33Z","2014-10-22T23:18:28Z"
"*/RDPWrap-v*.zip*",".{0,1000}\/RDPWrap\-v.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","rdpwrap","RDP Wrapper Library used by malwares","T1021","TA0008","N/A","N/A","Lateral Movement","https://github.com/stascorp/rdpwrap","1","1","N/A","N/A","10","10","15129","3891","2024-06-18T15:08:33Z","2014-10-22T23:18:28Z"
"*/RealTimeSync.exe*",".{0,1000}\/RealTimeSync\.exe.{0,1000}","greyware_tool_keyword","freefilesync","freefilesync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","LockBit","Data Exfiltration","https://freefilesync.org/download.php","1","1","N/A","N/A","9","10","N/A","N/A","N/A","N/A"
"*/RedTeaming-Tactics-and-Techniques.git*",".{0,1000}\/RedTeaming\-Tactics\-and\-Techniques\.git.{0,1000}","greyware_tool_keyword","ired.team","Red Teaming Tactics and Techniques","T1593.003","TA0043","N/A","N/A","Reconnaissance","https://github.com/mantvydasb/RedTeaming-Tactics-and-Techniques","1","1","N/A","N/A","7","10","4173","1068","2024-08-22T07:17:31Z","2019-03-02T13:33:33Z"
"*/release/gt-win-x86_64.exe*",".{0,1000}\/release\/gt\-win\-x86_64\.exe.{0,1000}","greyware_tool_keyword","gt","Fast WebSocket(s)/HTTP(s)/TCP relay proxy for making tunnels to localhost.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ao-space/gt","1","1","N/A","N/A","10","10","127","36","2024-10-30T00:37:47Z","2021-11-29T03:09:56Z"
"*/release/sshx-server*",".{0,1000}\/release\/sshx\-server.{0,1000}","greyware_tool_keyword","sshx","Fast collaborative live terminal sharing over the web","T1021.004 - T1041 - T1059 - T1071.001","TA0002 - TA0009 - TA0011 - TA0010","N/A","N/A","C2","https://github.com/ekzhang/sshx","1","1","N/A","N/A","10","10","6284","208","2025-02-12T20:40:30Z","2022-02-12T23:29:33Z"
"*/releases/download/Ahk2Exe*",".{0,1000}\/releases\/download\/Ahk2Exe.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*/RemCom.exe*",".{0,1000}\/RemCom\.exe.{0,1000}","greyware_tool_keyword","RemCom","Remote Command Executor: A OSS replacement for PsExec and RunAs","T1077 - T1059 - T1021 - T1569.002","TA0002 - TA0005 - TA0008","N/A","APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando ","Lateral Movement","https://github.com/kavika13/RemCom","1","1","N/A","N/A","10","4","344","97","2017-10-30T04:48:38Z","2011-11-09T11:00:09Z"
"*/RemCom.git*",".{0,1000}\/RemCom\.git.{0,1000}","greyware_tool_keyword","RemCom","Remote Command Executor: A OSS replacement for PsExec and RunAs","T1077 - T1059 - T1021 - T1569.002","TA0002 - TA0005 - TA0008","N/A","APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando ","Lateral Movement","https://github.com/kavika13/RemCom","1","1","N/A","N/A","10","4","344","97","2017-10-30T04:48:38Z","2011-11-09T11:00:09Z"
"*/RemComSvc.exe*",".{0,1000}\/RemComSvc\.exe.{0,1000}","greyware_tool_keyword","RemCom","Remote Command Executor: A OSS replacement for PsExec and RunAs","T1077 - T1059 - T1021 - T1569.002","TA0002 - TA0005 - TA0008","N/A","APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando ","Lateral Movement","https://github.com/kavika13/RemCom","1","1","N/A","N/A","10","4","344","97","2017-10-30T04:48:38Z","2011-11-09T11:00:09Z"
"*/Remote.It-Installer-*",".{0,1000}\/Remote\.It\-Installer\-.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/desktop","1","1","N/A","N/A","10","10","44","11","2025-01-22T07:41:56Z","2019-01-12T00:59:20Z"
"*/RemoteControlSetup.exe*",".{0,1000}\/RemoteControlSetup\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemoteDesktop.exe*",".{0,1000}\/RemoteDesktop\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/remoteit.exe*",".{0,1000}\/remoteit\.exe.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/desktop","1","1","N/A","N/A","10","10","44","11","2025-01-22T07:41:56Z","2019-01-12T00:59:20Z"
"*/remoteit.x86-win.exe*",".{0,1000}\/remoteit\.x86\-win\.exe.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/desktop","1","1","N/A","N/A","10","10","44","11","2025-01-22T07:41:56Z","2019-01-12T00:59:20Z"
"*/remoteit/connectd/releases*",".{0,1000}\/remoteit\/connectd\/releases.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/installer","1","1","N/A","N/A","10","10","24","9","2024-04-17T00:45:45Z","2019-01-29T21:06:02Z"
"*/remoteit/desktop*",".{0,1000}\/remoteit\/desktop.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/desktop","1","1","N/A","N/A","10","10","44","11","2025-01-22T07:41:56Z","2019-01-12T00:59:20Z"
"*/remoteit-desktop.exe*",".{0,1000}\/remoteit\-desktop\.exe.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/desktop","1","1","N/A","N/A","10","10","44","11","2025-01-22T07:41:56Z","2019-01-12T00:59:20Z"
"*/remotemoe.git*",".{0,1000}\/remotemoe\.git.{0,1000}","greyware_tool_keyword","remotemoe","remotemoe is a software daemon for exposing ad-hoc services to the internet without having to deal with the regular network stuff such as configuring VPNs - changing firewalls - or adding port forwards","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/fasmide/remotemoe","1","1","N/A","N/A","10","10","284","32","2024-06-03T14:00:47Z","2020-06-11T07:41:03Z"
"*/remotepc.deb*",".{0,1000}\/remotepc\.deb.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/remotepc.deb*",".{0,1000}\/remotepc\.deb.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePC.exe*",".{0,1000}\/RemotePC\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePC.exe*",".{0,1000}\/RemotePC\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePC.lnk*",".{0,1000}\/RemotePC\.lnk.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePC.tmp*",".{0,1000}\/RemotePC\.tmp.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/remotepc-attended.deb*",".{0,1000}\/remotepc\-attended\.deb.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePCAttended.dmg*",".{0,1000}\/RemotePCAttended\.dmg.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*/remotepclauncher.exe*",".{0,1000}\/remotepclauncher\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePCSuite.dmg*",".{0,1000}\/RemotePCSuite\.dmg.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*/remotepcuiu.exe*",".{0,1000}\/remotepcuiu\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePCViewer.msi*",".{0,1000}\/RemotePCViewer\.msi.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/restic-*.tar.gz*",".{0,1000}\/restic\-.{0,1000}\.tar\.gz.{0,1000}","greyware_tool_keyword","restic","backup program used by threat actors for data exfiltration","T1567","TA0009 - TA0010","N/A","INC Ransom - Lynx","Data Exfiltration","https://github.com/restic/restic","1","1","N/A","N/A","8","10","27784","1585","2025-03-01T01:53:27Z","2014-04-27T14:07:58Z"
"*/restic.exe*",".{0,1000}\/restic\.exe.{0,1000}","greyware_tool_keyword","restic","backup program used by threat actors for data exfiltration","T1567","TA0009 - TA0010","N/A","INC Ransom - Lynx","Data Exfiltration","https://github.com/restic/restic","1","1","N/A","N/A","8","10","27784","1585","2025-03-01T01:53:27Z","2014-04-27T14:07:58Z"
"*/restic/releases/download/*",".{0,1000}\/restic\/releases\/download\/.{0,1000}","greyware_tool_keyword","restic","backup program used by threat actors for data exfiltration","T1567","TA0009 - TA0010","N/A","INC Ransom - Lynx","Data Exfiltration","https://github.com/restic/restic","1","1","N/A","N/A","8","10","27784","1585","2025-03-01T01:53:27Z","2014-04-27T14:07:58Z"
"*/restic_*_windows_amd64.zip*",".{0,1000}\/restic_.{0,1000}_windows_amd64\.zip.{0,1000}","greyware_tool_keyword","restic","backup program used by threat actors for data exfiltration","T1567","TA0009 - TA0010","N/A","INC Ransom - Lynx","Data Exfiltration","https://github.com/restic/restic","1","1","N/A","N/A","8","10","27784","1585","2025-03-01T01:53:27Z","2014-04-27T14:07:58Z"
"*/restic-master/*",".{0,1000}\/restic\-master\/.{0,1000}","greyware_tool_keyword","restic","backup program used by threat actors for data exfiltration","T1567","TA0009 - TA0010","N/A","INC Ransom - Lynx","Data Exfiltration","https://github.com/restic/restic","1","1","N/A","N/A","8","10","27784","1585","2025-03-01T01:53:27Z","2014-04-27T14:07:58Z"
"*/reverse-tunnel.git*",".{0,1000}\/reverse\-tunnel\.git.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","N/A","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/reverse-tunnel/agent/cmd*",".{0,1000}\/reverse\-tunnel\/agent\/cmd.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","N/A","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/reverse-tunnel/server/service*",".{0,1000}\/reverse\-tunnel\/server\/service.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","N/A","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/RevoUninProSetup.exe*",".{0,1000}\/RevoUninProSetup\.exe.{0,1000}","greyware_tool_keyword","RevoUninstaller","legitimate tool abused by the Dispossessor ransomware group","T1562.001 - T1112 - T1059 - T1036","TA0005 - TA0040","N/A","Dispossessor","Defense Evasion","https://vx-underground.org/Archive/Dispossessor%20Leaks","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rfusclient.exe*",".{0,1000}\/rfusclient\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rmm/api/tacticalrmm/*",".{0,1000}\/rmm\/api\/tacticalrmm\/.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/rmm-installer.ps1*",".{0,1000}\/rmm\-installer\.ps1.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/RpcDND_Console.exe*",".{0,1000}\/RpcDND_Console\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rpcdownloader.exe*",".{0,1000}\/rpcdownloader\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RPCFireWallRule.exe*",".{0,1000}\/RPCFireWallRule\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rpcperfviewer.exe*",".{0,1000}\/rpcperfviewer\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RPCProxyLatency.exe*",".{0,1000}\/RPCProxyLatency\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rserver3.exe*",".{0,1000}\/rserver3\.exe.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rsocks.git*",".{0,1000}\/rsocks\.git.{0,1000}","greyware_tool_keyword","rsocks","reverse socks5 client & server","T1090 - T1571 - T1071 - T1095","TA0011 - TA0001 - TA0008","N/A","Scattered Spider*","C2","https://github.com/brimstone/rsocks","1","1","N/A","N/A","10","10","84","30","2020-01-09T20:45:32Z","2018-01-05T03:09:07Z"
"*/rsocks/releases/download/*",".{0,1000}\/rsocks\/releases\/download\/.{0,1000}","greyware_tool_keyword","rsocks","reverse socks5 client & server","T1090 - T1571 - T1071 - T1095","TA0011 - TA0001 - TA0008","N/A","Scattered Spider*","C2","https://github.com/brimstone/rsocks","1","1","N/A","N/A","10","10","84","30","2020-01-09T20:45:32Z","2018-01-05T03:09:07Z"
"*/rsocks_linux_amd64*",".{0,1000}\/rsocks_linux_amd64.{0,1000}","greyware_tool_keyword","rsocks","reverse socks5 client & server","T1090 - T1571 - T1071 - T1095","TA0011 - TA0001 - TA0008","N/A","Scattered Spider*","C2","https://github.com/brimstone/rsocks","1","1","#linux","N/A","10","10","84","30","2020-01-09T20:45:32Z","2018-01-05T03:09:07Z"
"*/rsocks_windows_386.exe*",".{0,1000}\/rsocks_windows_386\.exe.{0,1000}","greyware_tool_keyword","rsocks","reverse socks5 client & server","T1090 - T1571 - T1071 - T1095","TA0011 - TA0001 - TA0008","N/A","Scattered Spider*","C2","https://github.com/brimstone/rsocks","1","1","N/A","N/A","10","10","84","30","2020-01-09T20:45:32Z","2018-01-05T03:09:07Z"
"*/rtun-freebsd-amd64*",".{0,1000}\/rtun\-freebsd\-amd64.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","N/A","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/rtun-linux-amd64*",".{0,1000}\/rtun\-linux\-amd64.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","#linux","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/rtun-linux-arm64*",".{0,1000}\/rtun\-linux\-arm64.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","#linux","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/rtun-mac-amd64*",".{0,1000}\/rtun\-mac\-amd64.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","N/A","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/rtun-server-freebsd-amd64*",".{0,1000}\/rtun\-server\-freebsd\-amd64.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","N/A","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/rtun-server-linux-amd64*",".{0,1000}\/rtun\-server\-linux\-amd64.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","#linux","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/rtun-server-linux-arm64*",".{0,1000}\/rtun\-server\-linux\-arm64.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","#linux","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/rtun-server-mac-amd64*",".{0,1000}\/rtun\-server\-mac\-amd64.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","N/A","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/rtun-server-windows-amd64.exe*",".{0,1000}\/rtun\-server\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","N/A","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/rtun-windows-amd64.exe*",".{0,1000}\/rtun\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","N/A","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*/RustDesk.exe*",".{0,1000}\/RustDesk\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*/rustdesk.git*",".{0,1000}\/rustdesk\.git.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*/rustdesk/rustdesk/releases/*",".{0,1000}\/rustdesk\/rustdesk\/releases\/.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*/rutserv.exe*",".{0,1000}\/rutserv\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rutview.exe*",".{0,1000}\/rutview\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/sdelete.exe*",".{0,1000}\/sdelete\.exe.{0,1000}","greyware_tool_keyword","sdelete","SDelete is an application that securely deletes data in a way that makes it unrecoverable.- abused by attackers","T1485 - T1070.004","TA0005 - TA0040 ","N/A","APT29 - Sandworm - Cobalt Group - FIN5 - Silence - BOSS SPIDER","Defense Evasion","https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*/SDelete.zip*",".{0,1000}\/SDelete\.zip.{0,1000}","greyware_tool_keyword","sdelete","SDelete is an application that securely deletes data in a way that makes it unrecoverable.- abused by attackers","T1485 - T1070.004","TA0005 - TA0040 ","N/A","APT29 - Sandworm - Cobalt Group - FIN5 - Silence - BOSS SPIDER","Defense Evasion","https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*/sdelete64.exe*",".{0,1000}\/sdelete64\.exe.{0,1000}","greyware_tool_keyword","sdelete","SDelete is an application that securely deletes data in a way that makes it unrecoverable.- abused by attackers","T1485 - T1070.004","TA0005 - TA0040 ","N/A","APT29 - Sandworm - Cobalt Group - FIN5 - Silence - BOSS SPIDER","Defense Evasion","https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*/sdelete64a.exe*",".{0,1000}\/sdelete64a\.exe.{0,1000}","greyware_tool_keyword","sdelete","delete one or more files and/or directories, or to cleanse the free space on a logical disk - abused by attackers","T1485 - T1070.004","TA0005 - TA0040 ","N/A","APT29 - Sandworm - Cobalt Group - FIN5 - Silence - BOSS SPIDER","Defense Evasion","https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*/send.exploit.in/*",".{0,1000}\/send\.exploit\.in\/.{0,1000}","greyware_tool_keyword","send.exploit.in","file-sharing platform used by ransomware groups","T1567","TA0010","N/A","Black Basta","Data Exfiltration","https://www.cisa.gov/sites/default/files/publications/aa22-321a_joint_csa_stopransomware_hive.pdf","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*/SetACL.exe*",".{0,1000}\/SetACL\.exe.{0,1000}","greyware_tool_keyword","SetACL","Manage Windows permissions from the command line","T1069 - T1222","TA0002 - TA0004 - TA0005","N/A","N/A","Defense Evasion","https://helgeklein.com/download/","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*/SetACL64..exe*",".{0,1000}\/SetACL64\.\.exe.{0,1000}","greyware_tool_keyword","SetACL","Manage Windows permissions from the command line","T1069 - T1222","TA0002 - TA0004 - TA0005","N/A","N/A","Defense Evasion","https://helgeklein.com/download/","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*/set-proxy.ps1*",".{0,1000}\/set\-proxy\.ps1.{0,1000}","greyware_tool_keyword","yakit","security platform with fuzzers - webshell and MITM (chinese burp)","T1557 - T1557.003 - T1569.002","TA0001 - TA0040","N/A","N/A","Sniffing & Spoofing","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","7","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*/Shadowsocks-*.zip*",".{0,1000}\/Shadowsocks\-.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","shadowsocks","shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-windows","1","1","N/A","N/A","10","10","58635","16369","2025-01-01T08:09:55Z","2013-01-14T07:54:16Z"
"*/Shadowsocks.zip*",".{0,1000}\/Shadowsocks\.zip.{0,1000}","greyware_tool_keyword","shadowsocks","shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-windows","1","1","N/A","N/A","10","10","58635","16369","2025-01-01T08:09:55Z","2013-01-14T07:54:16Z"
"*/shadowsocks-rust.default*",".{0,1000}\/shadowsocks\-rust\.default.{0,1000}","greyware_tool_keyword","shadowsocks","Rust port - shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-rust","1","1","N/A","N/A","10","10","9082","1253","2025-03-02T14:57:16Z","2014-10-15T11:02:36Z"
"*/shadowsocks-rust.git*",".{0,1000}\/shadowsocks\-rust\.git.{0,1000}","greyware_tool_keyword","shadowsocks","Rust port - shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-rust","1","1","N/A","N/A","10","10","9082","1253","2025-03-02T14:57:16Z","2014-10-15T11:02:36Z"
"*/shadowsocks-rust.init*",".{0,1000}\/shadowsocks\-rust\.init.{0,1000}","greyware_tool_keyword","shadowsocks","Rust port - shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-rust","1","1","N/A","N/A","10","10","9082","1253","2025-03-02T14:57:16Z","2014-10-15T11:02:36Z"
"*/shadowsocks-rust.service*",".{0,1000}\/shadowsocks\-rust\.service.{0,1000}","greyware_tool_keyword","shadowsocks","Rust port - shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-rust","1","1","N/A","N/A","10","10","9082","1253","2025-03-02T14:57:16Z","2014-10-15T11:02:36Z"
"*/shadowsocks-service*",".{0,1000}\/shadowsocks\-service.{0,1000}","greyware_tool_keyword","shadowsocks","Rust port - shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-rust","1","1","N/A","N/A","10","10","9082","1253","2025-03-02T14:57:16Z","2014-10-15T11:02:36Z"
"*/shadowsocks-windows.git*",".{0,1000}\/shadowsocks\-windows\.git.{0,1000}","greyware_tool_keyword","shadowsocks","shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-windows","1","1","N/A","N/A","10","10","58635","16369","2025-01-01T08:09:55Z","2013-01-14T07:54:16Z"
"*/simplehelper64.exe*",".{0,1000}\/simplehelper64\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/SirTunnel.git*",".{0,1000}\/SirTunnel\.git.{0,1000}","greyware_tool_keyword","SirTunnel","SirTunnel enables you to securely expose a webserver running on your computer to a public URL using HTTPS.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/anderspitman/SirTunnel","1","1","N/A","N/A","10","10","1404","119","2024-03-24T20:15:50Z","2020-09-23T00:15:26Z"
"*/sirtunnel.py*",".{0,1000}\/sirtunnel\.py.{0,1000}","greyware_tool_keyword","SirTunnel","SirTunnel enables you to securely expose a webserver running on your computer to a public URL using HTTPS.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/anderspitman/SirTunnel","1","1","N/A","N/A","10","10","1404","119","2024-03-24T20:15:50Z","2020-09-23T00:15:26Z"
"*/sish.git*",".{0,1000}\/sish\.git.{0,1000}","greyware_tool_keyword","sish","HTTP(S)/WS(S)/TCP Tunnels to localhost using only SSH.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/antoniomika/sish","1","1","N/A","N/A","10","10","4134","317","2025-02-23T16:05:12Z","2019-02-15T15:36:23Z"
"*/SoftEtherVPN-*.tar.xz*",".{0,1000}\/SoftEtherVPN\-.{0,1000}\.tar\.xz.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*/SoftEtherVPN.git*",".{0,1000}\/SoftEtherVPN\.git.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","abused https://asec.ahnlab.com/en/66843/","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*/SoftEtherVPN/releases/tag/*",".{0,1000}\/SoftEtherVPN\/releases\/tag\/.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*/softether-vpnclient-*.exe*",".{0,1000}\/softether\-vpnclient\-.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*/softether-vpnserver-*.deb*",".{0,1000}\/softether\-vpnserver\-.{0,1000}\.deb.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*/softether-vpnserver_*.exe*",".{0,1000}\/softether\-vpnserver_.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*/SolarWinds-Dameware-DRS-St.exe*",".{0,1000}\/SolarWinds\-Dameware\-DRS\-St\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*/sources.list.d/tailscale.list*",".{0,1000}\/sources\.list\.d\/tailscale\.list.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/sshtunnel.git*",".{0,1000}\/sshtunnel\.git.{0,1000}","greyware_tool_keyword","sshtunnel","SSH tunnels to remote server","T1572 - T1219","TA0005 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://github.com/pahaz/sshtunnel","1","1","N/A","N/A","10","10","1246","185","2024-03-10T15:20:42Z","2014-06-11T21:14:05Z"
"*/sshtunnel.py*",".{0,1000}\/sshtunnel\.py.{0,1000}","greyware_tool_keyword","sshtunnel","SSH tunnels to remote server","T1572 - T1219","TA0005 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://github.com/pahaz/sshtunnel","1","1","N/A","N/A","10","10","1246","185","2024-03-10T15:20:42Z","2014-06-11T21:14:05Z"
"*/sshtunnel/tarball/*",".{0,1000}\/sshtunnel\/tarball\/.{0,1000}","greyware_tool_keyword","sshtunnel","SSH tunnels to remote server","T1572 - T1219","TA0005 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://github.com/pahaz/sshtunnel","1","1","N/A","N/A","10","10","1246","185","2024-03-10T15:20:42Z","2014-06-11T21:14:05Z"
"*/sshtunnel/zipball/*",".{0,1000}\/sshtunnel\/zipball\/.{0,1000}","greyware_tool_keyword","sshtunnel","SSH tunnels to remote server","T1572 - T1219","TA0005 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://github.com/pahaz/sshtunnel","1","1","N/A","N/A","10","10","1246","185","2024-03-10T15:20:42Z","2014-06-11T21:14:05Z"
"*/sshuttle.git*",".{0,1000}\/sshuttle\.git.{0,1000}","greyware_tool_keyword","sshuttle","Transparent proxy server that works as a poor man's VPN. Forwards over ssh","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/sshuttle/sshuttle","1","1","#linux","N/A","10","10","12039","752","2025-03-02T09:39:56Z","2014-09-15T04:51:13Z"
"*/sshuttle.py*",".{0,1000}\/sshuttle\.py.{0,1000}","greyware_tool_keyword","sshuttle","Transparent proxy server that works as a poor man's VPN. Forwards over ssh","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/sshuttle/sshuttle","1","1","#linux","N/A","10","10","12039","752","2025-03-02T09:39:56Z","2014-09-15T04:51:13Z"
"*/sshuttle/tarball*",".{0,1000}\/sshuttle\/tarball.{0,1000}","greyware_tool_keyword","sshuttle","Transparent proxy server that works as a poor man's VPN. Forwards over ssh","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/sshuttle/sshuttle","1","1","#linux","N/A","10","10","12039","752","2025-03-02T09:39:56Z","2014-09-15T04:51:13Z"
"*/sshuttle/zipball*",".{0,1000}\/sshuttle\/zipball.{0,1000}","greyware_tool_keyword","sshuttle","Transparent proxy server that works as a poor man's VPN. Forwards over ssh","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/sshuttle/sshuttle","1","1","#linux","N/A","10","10","12039","752","2025-03-02T09:39:56Z","2014-09-15T04:51:13Z"
"*/sshx-server/*",".{0,1000}\/sshx\-server\/.{0,1000}","greyware_tool_keyword","sshx","Fast collaborative live terminal sharing over the web","T1021.004 - T1041 - T1059 - T1071.001","TA0002 - TA0009 - TA0011 - TA0010","N/A","N/A","C2","https://github.com/ekzhang/sshx","1","1","N/A","N/A","10","10","6284","208","2025-02-12T20:40:30Z","2022-02-12T23:29:33Z"
"*/stunnel-latest.tar.gz*",".{0,1000}\/stunnel\-latest\.tar\.gz.{0,1000}","greyware_tool_keyword","stunnel","Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs","T1573 - T1071 - T1090","TA0010 - TA0011 - TA0003","N/A","APT37 - APT38 - Kimsuky","C2","https://www.stunnel.org/index.html","1","1","N/A","N/A","7","8","N/A","N/A","N/A","N/A"
"*/stunnel-latest-android.zip*",".{0,1000}\/stunnel\-latest\-android\.zip.{0,1000}","greyware_tool_keyword","stunnel","Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs","T1573 - T1071 - T1090","TA0010 - TA0011 - TA0003","N/A","APT37 - APT38 - Kimsuky","C2","https://www.stunnel.org/index.html","1","1","N/A","N/A","7","8","N/A","N/A","N/A","N/A"
"*/stunnel-latest-win64-installer.exe*",".{0,1000}\/stunnel\-latest\-win64\-installer\.exe.{0,1000}","greyware_tool_keyword","stunnel","Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs","T1573 - T1071 - T1090","TA0010 - TA0011 - TA0003","N/A","APT37 - APT38 - Kimsuky","C2","https://www.stunnel.org/index.html","1","1","N/A","N/A","7","8","N/A","N/A","N/A","N/A"
"*/suo5.git*",".{0,1000}\/suo5\.git.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","N/A","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*/suo5/releases/*",".{0,1000}\/suo5\/releases\/.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","N/A","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*/suo5-darwin-amd64*",".{0,1000}\/suo5\-darwin\-amd64.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","#linux","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*/suo5-darwin-arm64*",".{0,1000}\/suo5\-darwin\-arm64.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","#linux","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*/suo5-gui-darwin.app.zip*",".{0,1000}\/suo5\-gui\-darwin\.app\.zip.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","#linux","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*/suo5-gui-linux*",".{0,1000}\/suo5\-gui\-linux.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","#linux","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*/suo5-gui-windows.exe*",".{0,1000}\/suo5\-gui\-windows\.exe.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","N/A","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*/suo5-linux-amd64*",".{0,1000}\/suo5\-linux\-amd64.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","#linux","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*/suo5-linux-arm64*",".{0,1000}\/suo5\-linux\-arm64.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","#linux","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*/suo5-windows-amd64.exe*",".{0,1000}\/suo5\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","N/A","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*/Supremo.exe*",".{0,1000}\/Supremo\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/syncthing.exe*",".{0,1000}\/syncthing\.exe.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*/syncthing/releases/latest*",".{0,1000}\/syncthing\/releases\/latest.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*/syncthing-linux-*",".{0,1000}\/syncthing\-linux\-.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","#linux","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*/tacticalagent-v*-*.exe*",".{0,1000}\/tacticalagent\-v.{0,1000}\-.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/tacticalagent-v*-linux-arm.exe*",".{0,1000}\/tacticalagent\-v.{0,1000}\-linux\-arm\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","#linux","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/tacticalagent-v*-windows-amd64.exe*",".{0,1000}\/tacticalagent\-v.{0,1000}\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/tacticalrmm.exe*",".{0,1000}\/tacticalrmm\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/tacticalrmm.git*",".{0,1000}\/tacticalrmm\.git.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/tacticalrmm/master/install.sh*",".{0,1000}\/tacticalrmm\/master\/install\.sh.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/tacticalrmm/releases/latest*",".{0,1000}\/tacticalrmm\/releases\/latest.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/tacticalrmm-web.git*",".{0,1000}\/tacticalrmm\-web\.git.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*/tailscale.exe*",".{0,1000}\/tailscale\.exe.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/tailscale/client/*",".{0,1000}\/tailscale\/client\/.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/tailscale:unstable*",".{0,1000}\/tailscale\:unstable.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/tailscale_*_*.deb*",".{0,1000}\/tailscale_.{0,1000}_.{0,1000}\.deb.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/tailscale_*_*.tgz*",".{0,1000}\/tailscale_.{0,1000}_.{0,1000}\.tgz.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/tailscaled.defaults*",".{0,1000}\/tailscaled\.defaults.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/tailscaled.go*",".{0,1000}\/tailscaled\.go.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/tailscaled.sock*",".{0,1000}\/tailscaled\.sock.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/tailscale-setup-*-*.msi*",".{0,1000}\/tailscale\-setup\-.{0,1000}\-.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/tailscale-setup-*.exe*",".{0,1000}\/tailscale\-setup\-.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/TDSSKiller.exe*",".{0,1000}\/TDSSKiller\.exe.{0,1000}","greyware_tool_keyword","TDSKiller","TDSKiller detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","LockBit - Avaddon","Defense Evasion","https://www.majorgeeks.com/files/details/kaspersky_tdsskiller.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*/tdsskiller.zip*",".{0,1000}\/tdsskiller\.zip.{0,1000}","greyware_tool_keyword","TDSKiller","TDSKiller detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","LockBit - Avaddon","Defense Evasion","https://www.majorgeeks.com/files/details/kaspersky_tdsskiller.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*/test_tailscale.sh*",".{0,1000}\/test_tailscale\.sh.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*/tightvnc-*.msi*",".{0,1000}\/tightvnc\-.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/tkc_agent_dre.deb*",".{0,1000}\/tkc_agent_dre\.deb.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/tmate-ssh-server.*",".{0,1000}\/tmate\-ssh\-server\..{0,1000}","greyware_tool_keyword","tmate","Instant terminal sharing","T1071 - T1105 - T1573 - T1021","TA0010 - TA0011 - TA0008 - TA0002","N/A","WatchDog","C2","https://github.com/tmate-io/tmate-ssh-server","1","1","#linux","N/A","10","10","639","146","2024-06-21T11:52:24Z","2013-06-09T23:58:55Z"
"*/tmate-ssh-server.git*",".{0,1000}\/tmate\-ssh\-server\.git.{0,1000}","greyware_tool_keyword","tmate","Instant terminal sharing","T1071 - T1105 - T1573 - T1021","TA0010 - TA0011 - TA0008 - TA0002","N/A","WatchDog","C2","https://github.com/tmate-io/tmate-ssh-server","1","1","#linux","N/A","10","10","639","146","2024-06-21T11:52:24Z","2013-06-09T23:58:55Z"
"*/tmate-ssh-server/releases/*",".{0,1000}\/tmate\-ssh\-server\/releases\/.{0,1000}","greyware_tool_keyword","tmate","Instant terminal sharing","T1071 - T1105 - T1573 - T1021","TA0010 - TA0011 - TA0008 - TA0002","N/A","WatchDog","C2","https://github.com/tmate-io/tmate-ssh-server","1","1","#linux","N/A","10","10","639","146","2024-06-21T11:52:24Z","2013-06-09T23:58:55Z"
"*/tunnel.nosocket.php*",".{0,1000}\/tunnel\.nosocket\.php.{0,1000}","greyware_tool_keyword","Neo-reGeorg","Neo-reGeorg is a project that seeks to aggressively refactor reGeorg","T1090 - T1095 - T1572","TA0003 - TA0011 - TA0005 - TA0010","N/A","IRIDIUM","Data Exfiltration","https://github.com/L-codes/Neo-reGeorg","1","1","N/A","N/A","10","10","2994","452","2025-02-18T07:26:54Z","2019-07-08T14:25:42Z"
"*/tunneld.service*",".{0,1000}\/tunneld\.service.{0,1000}","greyware_tool_keyword","go-http-tunnel","Fast and secure tunnels over HTTP/2","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/mmatczuk/go-http-tunnel","1","1","N/A","N/A","10","10","3251","310","2024-04-19T12:25:30Z","2016-10-12T12:59:38Z"
"*/tunneller.git*",".{0,1000}\/tunneller\.git.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller/releases/*",".{0,1000}\/tunneller\/releases\/.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-darwin-amd64*",".{0,1000}\/tunneller\-darwin\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-darwin-amd64*",".{0,1000}\/tunneller\-darwin\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-darwin-amd64*",".{0,1000}\/tunneller\-darwin\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-darwin-amd64*",".{0,1000}\/tunneller\-darwin\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-darwin-i386*",".{0,1000}\/tunneller\-darwin\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-darwin-i386*",".{0,1000}\/tunneller\-darwin\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-darwin-i386*",".{0,1000}\/tunneller\-darwin\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-darwin-i386*",".{0,1000}\/tunneller\-darwin\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-freebsd-amd64*",".{0,1000}\/tunneller\-freebsd\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-freebsd-amd64*",".{0,1000}\/tunneller\-freebsd\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-freebsd-amd64*",".{0,1000}\/tunneller\-freebsd\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-freebsd-amd64*",".{0,1000}\/tunneller\-freebsd\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-freebsd-i386*",".{0,1000}\/tunneller\-freebsd\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-freebsd-i386*",".{0,1000}\/tunneller\-freebsd\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-freebsd-i386*",".{0,1000}\/tunneller\-freebsd\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-freebsd-i386*",".{0,1000}\/tunneller\-freebsd\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-linux-amd64*",".{0,1000}\/tunneller\-linux\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-linux-amd64*",".{0,1000}\/tunneller\-linux\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-linux-amd64*",".{0,1000}\/tunneller\-linux\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-linux-amd64*",".{0,1000}\/tunneller\-linux\-amd64.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-linux-i386*",".{0,1000}\/tunneller\-linux\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-linux-i386*",".{0,1000}\/tunneller\-linux\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-linux-i386*",".{0,1000}\/tunneller\-linux\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunneller-linux-i386*",".{0,1000}\/tunneller\-linux\-i386.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","#linux","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*/tunnelmole-client.git*",".{0,1000}\/tunnelmole\-client\.git.{0,1000}","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*/tunnelmole-service*",".{0,1000}\/tunnelmole\-service.{0,1000}","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*/tunnelmole-service.git*",".{0,1000}\/tunnelmole\-service\.git.{0,1000}","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*/tunnelto.git*",".{0,1000}\/tunnelto\.git.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*/tunnelto/releases/latest*",".{0,1000}\/tunnelto\/releases\/latest.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*/tunnelto_server*",".{0,1000}\/tunnelto_server.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*/tunnelto_server/*",".{0,1000}\/tunnelto_server\/.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*/tunwg.exe*",".{0,1000}\/tunwg\.exe.{0,1000}","greyware_tool_keyword","tunwg","End to end encrypted secure tunnel to local servers","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ntnj/tunwg","1","1","N/A","N/A","10","10","233","9","2024-09-18T15:03:45Z","2023-01-16T17:51:13Z"
"*/tunwg.git*",".{0,1000}\/tunwg\.git.{0,1000}","greyware_tool_keyword","tunwg","End to end encrypted secure tunnel to local servers","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ntnj/tunwg","1","1","N/A","N/A","10","10","233","9","2024-09-18T15:03:45Z","2023-01-16T17:51:13Z"
"*/tunwg@latest*",".{0,1000}\/tunwg\@latest.{0,1000}","greyware_tool_keyword","tunwg","End to end encrypted secure tunnel to local servers","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ntnj/tunwg","1","1","N/A","N/A","10","10","233","9","2024-09-18T15:03:45Z","2023-01-16T17:51:13Z"
"*/tunwg-arm64.exe*",".{0,1000}\/tunwg\-arm64\.exe.{0,1000}","greyware_tool_keyword","tunwg","End to end encrypted secure tunnel to local servers","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ntnj/tunwg","1","1","N/A","N/A","10","10","233","9","2024-09-18T15:03:45Z","2023-01-16T17:51:13Z"
"*/unlocker-setup.exe*",".{0,1000}\/unlocker\-setup\.exe.{0,1000}","greyware_tool_keyword","IObitUnlocker","unlocking locked files on Windows systems","T1222 - T1070 - T1485","TA0005 - TA0040","N/A","PLAY","Defense Evasion","https://www.iobit.com/en/iobit-unlocker.php#","1","1","N/A","often used legitimatly - admin tool","5","9","N/A","N/A","N/A","N/A"
"*/updog-*.tar.gz*",".{0,1000}\/updog\-.{0,1000}\.tar\.gz.{0,1000}","greyware_tool_keyword","updog","Updog is a replacement for SimpleHTTPServer. It allows uploading and downloading via HTTP/S can set ad hoc SSL certificates and use http basic auth.","T1567 - T1074.001 - T1020","TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://github.com/sc0tfree/updog","1","1","N/A","N/A","9","10","3013","311","2024-03-13T15:52:39Z","2020-02-18T15:29:21Z"
"*/updog.git*",".{0,1000}\/updog\.git.{0,1000}","greyware_tool_keyword","updog","Updog is a replacement for SimpleHTTPServer. It allows uploading and downloading via HTTP/S can set ad hoc SSL certificates and use http basic auth.","T1567 - T1074.001 - T1020","TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://github.com/sc0tfree/updog","1","1","N/A","N/A","9","10","3013","311","2024-03-13T15:52:39Z","2020-02-18T15:29:21Z"
"*/updog/archive/updog-*",".{0,1000}\/updog\/archive\/updog\-.{0,1000}","greyware_tool_keyword","updog","Updog is a replacement for SimpleHTTPServer. It allows uploading and downloading via HTTP/S can set ad hoc SSL certificates and use http basic auth.","T1567 - T1074.001 - T1020","TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://github.com/sc0tfree/updog","1","1","N/A","N/A","9","10","3013","311","2024-03-13T15:52:39Z","2020-02-18T15:29:21Z"
"*/uvs_v415eng.zip*",".{0,1000}\/uvs_v415eng\.zip.{0,1000}","greyware_tool_keyword","Universal Virus Sniffer","Universal Virus Sniffer detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","Phobos","Defense Evasion","https://www.majorgeeks.com/files/details/universal_virus_sniffer.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*/vbs2exe.exe*",".{0,1000}\/vbs2exe\.exe.{0,1000}","greyware_tool_keyword","redpill","Assist reverse tcp shells in post-exploration tasks","T1082 - T1016 - T1049 - T1057 - T1489 - T1070 - T1562 - T1563 - T1119 - T1518 - T1602 - T1530 - T1113 - T1125 - T1105 - T1133 - T1056 - T1114 - T1539 - T1552 - T1214 - T1110 - T1040 - T1436 - T1068 - T1088 - T1564 - T1112 - T1547 - T1574 - T1204 - T1215 - T1046 - T1557 - T1136 - T1059 - T1127 - T1555 - T1548 - T1115 - T1003","TA0007 - TA0003 - TA0005 - TA0009 - TA0002 - TA0006 - TA0004 - TA0010 - TA0011","N/A","N/A","Exploitation tool","https://github.com/r00t-3xp10it/redpill","1","1","N/A","N/A","10","3","216","52","2024-03-19T15:03:16Z","2021-02-20T23:59:07Z"
"*/viewerhostkeypopup.exe*",".{0,1000}\/viewerhostkeypopup\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/VncSharp.exe*",".{0,1000}\/VncSharp\.exe.{0,1000}","greyware_tool_keyword","VncSharp","VncSharp is a GPL implementation of the VNC Remote Framebuffer (RFB) Protocol for the .NET Framework","T1021.001 - T1219  - T1071.001","TA0007 - TA0008","Carbanak","FIN7 - Carbanak","Lateral Movement","https://github.com/humphd/VncSharp","1","1","N/A","N/A","8","3","246","177","2019-02-18T16:04:27Z","2012-03-05T15:23:41Z"
"*/VncSharp.git*",".{0,1000}\/VncSharp\.git.{0,1000}","greyware_tool_keyword","VncSharp","VncSharp is a GPL implementation of the VNC Remote Framebuffer (RFB) Protocol for the .NET Framework","T1021.001 - T1219  - T1071.001","TA0007 - TA0008","Carbanak","FIN7 - Carbanak","Lateral Movement","https://github.com/humphd/VncSharp","1","1","N/A","N/A","8","3","246","177","2019-02-18T16:04:27Z","2012-03-05T15:23:41Z"
"*/VPDAgent.exe*",".{0,1000}\/VPDAgent\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/VSAX_x64.msi*",".{0,1000}\/VSAX_x64\.msi.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/vsxrc-clip.exe*",".{0,1000}\/vsxrc\-clip\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/webhook.site.git*",".{0,1000}\/webhook\.site\.git.{0,1000}","greyware_tool_keyword","webhook.site","test HTTP webhooks with this handy tool that displays requests instantly - abused by attacker for payload callback confirmation","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/webhooksite/webhook.site","1","1","N/A","N/A","10","10","5694","441","2024-10-16T08:45:00Z","2016-03-21T08:45:42Z"
"*/webvulnscan1*.exe*",".{0,1000}\/webvulnscan1.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Acunetix Web Vulnerability Scanner","Vulnerability Scanner abused by threat actors","T1190 - T1046 - T1210 - T1213","TA0001 - TA0008 - TA0009","N/A","Clever Kitten - EMBER BEAR","Vulnerability Scanner","https://www.acunetix.com/vulnerability-scanner/","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*/webvulnscan2*.exe*",".{0,1000}\/webvulnscan2.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Acunetix Web Vulnerability Scanner","Vulnerability Scanner abused by threat actors","T1190 - T1046 - T1210 - T1213","TA0001 - TA0008 - TA0009","N/A","Clever Kitten - EMBER BEAR","Vulnerability Scanner","https://www.acunetix.com/vulnerability-scanner/","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*/webvulnscan3*.exe*",".{0,1000}\/webvulnscan3.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Acunetix Web Vulnerability Scanner","Vulnerability Scanner abused by threat actors","T1190 - T1046 - T1210 - T1213","TA0001 - TA0008 - TA0009","N/A","Clever Kitten - EMBER BEAR","Vulnerability Scanner","https://www.acunetix.com/vulnerability-scanner/","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*/Win7Taskbar.dll*",".{0,1000}\/Win7Taskbar\.dll.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Wireguard.zip*",".{0,1000}\/Wireguard\.zip.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","Defense Evasion","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wireguard-amd64-*.msi*",".{0,1000}\/wireguard\-amd64\-.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","Defense Evasion","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wireguard-installer.exe*",".{0,1000}\/wireguard\-installer\.exe.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","Defense Evasion","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wireguard-installer.rar*",".{0,1000}\/wireguard\-installer\.rar.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","Defense Evasion","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wireproxy.conf*",".{0,1000}\/wireproxy\.conf.{0,1000}","greyware_tool_keyword","wireproxy","Wireguard client that exposes itself as a socks5 proxy","T1572 - T1090 - T1071.004","TA0011 - TA0005","N/A","N/A","C2","https://github.com/pufferffish/wireproxy","1","1","#linux","N/A","10","10","4794","293","2025-02-19T17:22:57Z","2022-03-11T12:32:10Z"
"*/wireproxy.git*",".{0,1000}\/wireproxy\.git.{0,1000}","greyware_tool_keyword","wireproxy","Wireguard client that exposes itself as a socks5 proxy","T1572 - T1090 - T1071.004","TA0011 - TA0005","N/A","N/A","C2","https://github.com/pufferffish/wireproxy","1","1","N/A","N/A","10","10","4794","293","2025-02-19T17:22:57Z","2022-03-11T12:32:10Z"
"*/wireproxy.service*",".{0,1000}\/wireproxy\.service.{0,1000}","greyware_tool_keyword","wireproxy","Wireguard client that exposes itself as a socks5 proxy","T1572 - T1090 - T1071.004","TA0011 - TA0005","N/A","N/A","C2","https://github.com/pufferffish/wireproxy","1","1","#linux","N/A","10","10","4794","293","2025-02-19T17:22:57Z","2022-03-11T12:32:10Z"
"*/wireproxy/releases/*",".{0,1000}\/wireproxy\/releases\/.{0,1000}","greyware_tool_keyword","wireproxy","Wireguard client that exposes itself as a socks5 proxy","T1572 - T1090 - T1071.004","TA0011 - TA0005","N/A","N/A","C2","https://github.com/pufferffish/wireproxy","1","1","N/A","N/A","10","10","4794","293","2025-02-19T17:22:57Z","2022-03-11T12:32:10Z"
"*/wireproxy_darwin*",".{0,1000}\/wireproxy_darwin.{0,1000}","greyware_tool_keyword","wireproxy","Wireguard client that exposes itself as a socks5 proxy","T1572 - T1090 - T1071.004","TA0011 - TA0005","N/A","N/A","C2","https://github.com/pufferffish/wireproxy","1","1","#linux","N/A","10","10","4794","293","2025-02-19T17:22:57Z","2022-03-11T12:32:10Z"
"*/wireproxy_linux_*",".{0,1000}\/wireproxy_linux_.{0,1000}","greyware_tool_keyword","wireproxy","Wireguard client that exposes itself as a socks5 proxy","T1572 - T1090 - T1071.004","TA0011 - TA0005","N/A","N/A","C2","https://github.com/pufferffish/wireproxy","1","1","#linux","N/A","10","10","4794","293","2025-02-19T17:22:57Z","2022-03-11T12:32:10Z"
"*/wireproxy_windows*",".{0,1000}\/wireproxy_windows.{0,1000}","greyware_tool_keyword","wireproxy","Wireguard client that exposes itself as a socks5 proxy","T1572 - T1090 - T1071.004","TA0011 - TA0005","N/A","N/A","C2","https://github.com/pufferffish/wireproxy","1","1","N/A","N/A","10","10","4794","293","2025-02-19T17:22:57Z","2022-03-11T12:32:10Z"
"*/wiretap.Dockerfile*",".{0,1000}\/wiretap\.Dockerfile.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap.exe*",".{0,1000}\/wiretap\.exe.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap.git*",".{0,1000}\/wiretap\.git.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap/releases/download/*",".{0,1000}\/wiretap\/releases\/download\/.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap_*_linux_386.tar.gz*",".{0,1000}\/wiretap_.{0,1000}_linux_386\.tar\.gz.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","#linux","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap_*_linux_amd64.tar.gz*",".{0,1000}\/wiretap_.{0,1000}_linux_amd64\.tar\.gz.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","#linux","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap_*_linux_arm64.tar.gz*",".{0,1000}\/wiretap_.{0,1000}_linux_arm64\.tar\.gz.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","#linux","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap_*_linux_armv6.tar.gz*",".{0,1000}\/wiretap_.{0,1000}_linux_armv6\.tar\.gz.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","#linux","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap_*_windows_386.tar.gz*",".{0,1000}\/wiretap_.{0,1000}_windows_386\.tar\.gz.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap_*_windows_amd64.tar.gz*",".{0,1000}\/wiretap_.{0,1000}_windows_amd64\.tar\.gz.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap_*_windows_arm64.tar.gz*",".{0,1000}\/wiretap_.{0,1000}_windows_arm64\.tar\.gz.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/wiretap_*_windows_armv6.tar.gz*",".{0,1000}\/wiretap_.{0,1000}_windows_armv6\.tar\.gz.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*/x86_64-pc-windows-msvc/release/gt.exe*",".{0,1000}\/x86_64\-pc\-windows\-msvc\/release\/gt\.exe.{0,1000}","greyware_tool_keyword","gt","Fast WebSocket(s)/HTTP(s)/TCP relay proxy for making tunnels to localhost.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ao-space/gt","1","1","N/A","N/A","10","10","127","36","2024-10-30T00:37:47Z","2021-11-29T03:09:56Z"
"*/x86_64-pc-windows-msvc/release/gt.exe*",".{0,1000}\/x86_64\-pc\-windows\-msvc\/release\/gt\.exe.{0,1000}","greyware_tool_keyword","gt","Fast WebSocket(s)/HTTP(s)/TCP relay proxy for making tunnels to localhost.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ao-space/gt","1","1","N/A","N/A","10","10","127","36","2024-10-30T00:37:47Z","2021-11-29T03:09:56Z"
"*/xmrig-*-gcc-win64.zip*",".{0,1000}\/xmrig\-.{0,1000}\-gcc\-win64\.zip.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*/xmrig.exe*",".{0,1000}\/xmrig\.exe.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*/xmrig.git*",".{0,1000}\/xmrig\.git.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*/yak_darwin_amd64.zip*",".{0,1000}\/yak_darwin_amd64\.zip.{0,1000}","greyware_tool_keyword","yakit","security platform with fuzzers - webshell and MITM (chinese burp)","T1557 - T1557.003 - T1569.002","TA0001 - TA0040","N/A","N/A","Sniffing & Spoofing","https://github.com/Gerenios/AADInternals","1","1","#linux","N/A","7","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*/yak_linux_amd64.zip*",".{0,1000}\/yak_linux_amd64\.zip.{0,1000}","greyware_tool_keyword","yakit","security platform with fuzzers - webshell and MITM (chinese burp)","T1557 - T1557.003 - T1569.002","TA0001 - TA0040","N/A","N/A","Sniffing & Spoofing","https://github.com/Gerenios/AADInternals","1","1","#linux","N/A","7","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*/yak_windows_amd64.zip*",".{0,1000}\/yak_windows_amd64\.zip.{0,1000}","greyware_tool_keyword","yakit","security platform with fuzzers - webshell and MITM (chinese burp)","T1557 - T1557.003 - T1569.002","TA0001 - TA0040","N/A","N/A","Sniffing & Spoofing","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","7","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*/ZA_Connect.exe*",".{0,1000}\/ZA_Connect\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/ZAAudioClient.exe*",".{0,1000}\/ZAAudioClient\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/ZAFileTransfer.exe*",".{0,1000}\/ZAFileTransfer\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/ZAService.exe*",".{0,1000}\/ZAService\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/zrok.exe*",".{0,1000}\/zrok\.exe.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*/zrok.git*",".{0,1000}\/zrok\.git.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*/zrok.zip*",".{0,1000}\/zrok\.zip.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*/zrok-amd64_darwin_amd64*",".{0,1000}\/zrok\-amd64_darwin_amd64.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","#linux","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*/zrok-arm64_darwin_arm64*",".{0,1000}\/zrok\-arm64_darwin_arm64.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","#linux","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*:8040/SetupWizard.aspx*",".{0,1000}\:8040\/SetupWizard\.aspx.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*:8070/tomcat/code/suo5.jsp*",".{0,1000}\:8070\/tomcat\/code\/suo5\.jsp.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","N/A","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*:9001/proxy/mdmserver1/account*",".{0,1000}\:9001\/proxy\/mdmserver1\/account.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*@email.webhook.site*",".{0,1000}\@email\.webhook\.site.{0,1000}","greyware_tool_keyword","webhook.site","test HTTP webhooks with this handy tool that displays requests instantly - abused by attacker for payload callback confirmation","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/webhooksite/webhook.site","1","1","N/A","N/A","10","10","5694","441","2024-10-16T08:45:00Z","2016-03-21T08:45:42Z"
"*159.69.126.209*",".{0,1000}159\.69\.126\.209.{0,1000}","greyware_tool_keyword","remotemoe","remotemoe is a software daemon for exposing ad-hoc services to the internet without having to deal with the regular network stuff such as configuring VPNs - changing firewalls - or adding port forwards","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/fasmide/remotemoe","1","1","N/A","N/A","10","10","284","32","2024-06-03T14:00:47Z","2020-06-11T07:41:03Z"
"*3proxy/3proxy*",".{0,1000}3proxy\/3proxy.{0,1000}","greyware_tool_keyword","3proxy","3proxy - tiny free proxy server","T1090 - T1583 - T1001 - T1132","TA0040 - TA0001 - TA0005 - TA0006","N/A","Lazarus Group","Defense Evasion","https://github.com/3proxy/3proxy","1","1","N/A","N/A","8","10","4103","800","2024-12-20T11:39:04Z","2014-04-08T08:59:11Z"
"*-443.devtunnels.ms*",".{0,1000}\-443\.devtunnels\.ms.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*4shared.com/*upload*",".{0,1000}4shared\.com\/.{0,1000}upload.{0,1000}","greyware_tool_keyword","4shared.com","Uploading on 4shared.com","T1105 - T1567 - T1071","TA0010 ","N/A","Turla","Data Exfiltration","4shared.com","1","1","#filehostingservice","N/A","9","8","N/A","N/A","N/A","N/A"
"*5ety7tpkim5me6eszuwcje7bmy25pbtrjtue7zkqqgziljwqy3rrikqd.onion*",".{0,1000}5ety7tpkim5me6eszuwcje7bmy25pbtrjtue7zkqqgziljwqy3rrikqd\.onion.{0,1000}","greyware_tool_keyword","OshiUpload","Ephemeral file sharing engine","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Black Basta","Data Exfiltration","https://github.com/somenonymous/OshiUpload","1","1","#filehostingservice #P2P","N/A","10","2","188","26","2022-10-01T04:08:29Z","2019-05-11T02:08:51Z"
"*625ae9460120.ngrok.io*",".{0,1000}625ae9460120\.ngrok\.io.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*7k3j6g3h67l23j345wennkoc4a2223rhjkba22o77ihzdj3achwa.remote.moe*",".{0,1000}7k3j6g3h67l23j345wennkoc4a2223rhjkba22o77ihzdj3achwa\.remote\.moe.{0,1000}","greyware_tool_keyword","remotemoe","remotemoe is a software daemon for exposing ad-hoc services to the internet without having to deal with the regular network stuff such as configuring VPNs - changing firewalls - or adding port forwards","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/fasmide/remotemoe","1","1","N/A","N/A","10","10","284","32","2024-06-03T14:00:47Z","2020-06-11T07:41:03Z"
"*a.aomeisoftware.com*",".{0,1000}a\.aomeisoftware\.com.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AADInternals.exe*",".{0,1000}AADInternals\.exe.{0,1000}","greyware_tool_keyword","AADInternals","AADInternals PowerShell module for administering Azure AD and Office 365","T1583 - T1558 - T1078 - T1136 - T1087 - T1114 - T1566 - T1056 - T1199 - T1098 - T1649 - T1621 - T1649","TA0006 - TA0003 - TA0004 - TA0005 - TA0007 - TA0009 - TA0011","N/A","APT29 - COZY BEAR","Exploitation tool","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","9","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*AADInternals.pdb*",".{0,1000}AADInternals\.pdb.{0,1000}","greyware_tool_keyword","AADInternals","AADInternals PowerShell module for administering Azure AD and Office 365","T1583 - T1558 - T1078 - T1136 - T1087 - T1114 - T1566 - T1056 - T1199 - T1098 - T1649 - T1621 - T1649","TA0006 - TA0003 - TA0004 - TA0005 - TA0007 - TA0009 - TA0011","N/A","APT29 - COZY BEAR","Exploitation tool","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","9","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*AADInternals.psd1*",".{0,1000}AADInternals\.psd1.{0,1000}","greyware_tool_keyword","AADInternals","AADInternals PowerShell module for administering Azure AD and Office 365","T1583 - T1558 - T1078 - T1136 - T1087 - T1114 - T1566 - T1056 - T1199 - T1098 - T1649 - T1621 - T1649","TA0006 - TA0003 - TA0004 - TA0005 - TA0007 - TA0009 - TA0011","N/A","APT29 - COZY BEAR","Exploitation tool","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","9","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*AADInternals.psm1*",".{0,1000}AADInternals\.psm1.{0,1000}","greyware_tool_keyword","AADInternals","AADInternals PowerShell module for administering Azure AD and Office 365","T1583 - T1558 - T1078 - T1136 - T1087 - T1114 - T1566 - T1056 - T1199 - T1098 - T1649 - T1621 - T1649","TA0006 - TA0003 - TA0004 - TA0005 - TA0007 - TA0009 - TA0011","N/A","APT29 - COZY BEAR","Exploitation tool","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","9","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*Ab4y98/VerySimpleAnyDeskBackdoor*",".{0,1000}Ab4y98\/VerySimpleAnyDeskBackdoor.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://github.com/Ab4y98/VerySimpleAnyDeskBackdoor/blob/main/AnydeskBackdoor.ps1","1","1","simple backdoor with anydesk","N/A","10","1","1","0","2023-12-14T09:58:30Z","2023-12-05T22:08:51Z"
"*ACLScanner.exe*",".{0,1000}ACLScanner\.exe.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner and Earth Lusca Operations Tools and commands","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf https://github.com/vletoux/pingcastle","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*acontrol.atera.com*",".{0,1000}acontrol\.atera\.com.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*action1_agent.exe*",".{0,1000}action1_agent\.exe.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*action1_remote.exe*",".{0,1000}action1_remote\.exe.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*action1_update.exe*",".{0,1000}action1_update\.exe.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*activate.netsupportsoftware.com*",".{0,1000}activate\.netsupportsoftware\.com.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*adexplorer.exe*",".{0,1000}adexplorer\.exe.{0,1000}","greyware_tool_keyword","adexplorer","Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database. It can be abused by malicious actors","T1003.001 - T1087.001","TA0006 - TA0007","N/A","Lapsus$ - Scattered Spider* - BlackBasta","Discovery","https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer","1","1","N/A","greyware tool - risks of False positive !","7","10","N/A","N/A","N/A","N/A"
"*adexplorer.zip*",".{0,1000}adexplorer\.zip.{0,1000}","greyware_tool_keyword","adexplorer","Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database. It can be abused by malicious actors","T1003.001 - T1087.001","TA0006 - TA0007","N/A","Lapsus$ - Scattered Spider* - BlackBasta","Discovery","https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer","1","1","N/A","greyware tool - risks of False positive !","7","10","N/A","N/A","N/A","N/A"
"*adexplorer64.exe*",".{0,1000}adexplorer64\.exe.{0,1000}","greyware_tool_keyword","adexplorer","Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database. It can be abused by malicious actors","T1003.001 - T1087.001","TA0006 - TA0007","N/A","Lapsus$ - Scattered Spider* - BlackBasta","Discovery","https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer","1","1","N/A","greyware tool - risks of False positive !","7","10","N/A","N/A","N/A","N/A"
"*adexplorer64a.exe*",".{0,1000}adexplorer64a\.exe.{0,1000}","greyware_tool_keyword","adexplorer","Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database. It can be abused by malicious actors","T1003.001 - T1087.001","TA0006 - TA0007","N/A","Lapsus$ - Scattered Spider* - BlackBasta","Discovery","https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer","1","1","N/A","greyware tool - risks of False positive !","7","10","N/A","N/A","N/A","N/A"
"*adfind.bat*",".{0,1000}adfind\.bat.{0,1000}","greyware_tool_keyword","adfind","Adfind is a command-line tool often used by administrators for Active Directory queries. However. attackers can misuse it to gather valuable information about the network environment. including user accounts. group memberships. domain controllers. and domain trusts. This gathered intelligence can aid in Lateral Movement. privilege escalation. or even data exfiltration. Such reconnaissance activities often precede more damaging attacks.","T1087 - T1016 - T1482","TA0007 - TA0008 - TA0043","N/A","APT29 - Akira - Black Basta - BlackSuit - Conti - COZY BEAR - Dagon Locker - Diavol - FIN6 - FIN7 - INC Ransom - LockBit - MAZE - MUSTANG PANDA - NetWalker - Nokoyawa - PLAY - Quantum - REvil - Royal - Ryuk - TA505 - TRAVELING SPIDER - Unit 29155 - WIZARD SPIDER - Wizard Spider - XingLocker - menuPass - Dispossessor","Discovery","https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/","1","1","N/A","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*adfind.exe*",".{0,1000}adfind\.exe.{0,1000}","greyware_tool_keyword","adfind","Adfind is a command-line tool often used by administrators for Active Directory queries. However. attackers can misuse it to gather valuable information about the network environment. including user accounts. group memberships. domain controllers. and domain trusts. This gathered intelligence can aid in Lateral Movement. privilege escalation. or even data exfiltration. Such reconnaissance activities often precede more damaging attacks.","T1087 - T1016 - T1482","TA0007 - TA0008 - TA0043","N/A","APT29 - Akira - Black Basta - BlackSuit - Conti - COZY BEAR - Dagon Locker - Diavol - FIN6 - FIN7 - INC Ransom - LockBit - MAZE - MUSTANG PANDA - NetWalker - Nokoyawa - PLAY - Quantum - REvil - Royal - Ryuk - TA505 - TRAVELING SPIDER - Unit 29155 - WIZARD SPIDER - Wizard Spider - XingLocker - menuPass - Dispossessor","Discovery","https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/","1","1","N/A","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*adiskreader.disks.raw*",".{0,1000}adiskreader\.disks\.raw.{0,1000}","greyware_tool_keyword","adiskreader","Async Python library to parse local and remote disk images","T1020 - T1048 - T1074 - T1560.001","TA0005 - TA0009 - TA0010","N/A","N/A","Data Exfiltration","https://github.com/skelsec/adiskreader","1","1","N/A","N/A","4","1","76","7","2024-09-05T14:46:56Z","2023-12-18T11:54:31Z"
"*adiskreader.disks.vhdx*",".{0,1000}adiskreader\.disks\.vhdx.{0,1000}","greyware_tool_keyword","adiskreader","Async Python library to parse local and remote disk images","T1020 - T1048 - T1074 - T1560.001","TA0005 - TA0009 - TA0010","N/A","N/A","Data Exfiltration","https://github.com/skelsec/adiskreader","1","1","N/A","N/A","4","1","76","7","2024-09-05T14:46:56Z","2023-12-18T11:54:31Z"
"*admin.*.swi-dre.com*",".{0,1000}admin\..{0,1000}\.swi\-dre\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ADRecon.ps1*",".{0,1000}ADRecon\.ps1.{0,1000}","greyware_tool_keyword","adrecon","ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.","T1018 - T1087.001 - T1069.001 - T1003.002 - T1482","TA0007 - TA0009 - TA0040","N/A","N/A","Discovery","https://github.com/adrecon/ADRecon","1","1","N/A","AD Enumeration","7","8","755","107","2024-10-15T03:41:29Z","2018-12-15T13:00:09Z"
"*adrecon/ADRecon*",".{0,1000}adrecon\/ADRecon.{0,1000}","greyware_tool_keyword","adrecon","ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.","T1018 - T1087.001 - T1069.001 - T1003.002 - T1482","TA0007 - TA0009 - TA0040","N/A","Scattered Spider*","Discovery","https://github.com/adrecon/ADRecon","1","1","N/A","AD Enumeration","7","8","755","107","2024-10-15T03:41:29Z","2018-12-15T13:00:09Z"
"*ADRecon-master.zip*",".{0,1000}ADRecon\-master\.zip.{0,1000}","greyware_tool_keyword","adrecon","ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.","T1018 - T1087.001 - T1069.001 - T1003.002 - T1482","TA0007 - TA0009 - TA0040","N/A","Scattered Spider*","Discovery","https://github.com/adrecon/ADRecon","1","1","N/A","AD Enumeration","7","8","755","107","2024-10-15T03:41:29Z","2018-12-15T13:00:09Z"
"*Advanced Monitoring Agent HTTP Retriever 1.1*",".{0,1000}Advanced\sMonitoring\sAgent\sHTTP\sRetriever\s1\.1.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","1","#useragent","user-agent","10","10","N/A","N/A","N/A","N/A"
"*Advanced_IP_Scanner*.exe*",".{0,1000}Advanced_IP_Scanner.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","advanced-ip-scanner","The program shows all network devices. gives you access to shared folders. provides remote control of computers (via RDP and Radmin) and can even remotely switch computers off. It is easy to use and runs as a portable edition (abused by TA)","T1135 - T1021 - T1016 - T1046","TA0007 - TA0043","N/A","MAZE - BlackSuit - Royal - Akira - LockBit - Diavol - GoGoogle - INC Ransom - Hive - ZolaConti2 - Darkside - UNC24653 - Egregor4 - Hades - Evilcorp5 - REvil6 - Ryuk - UNC18787 - UNC24477 - Vice Society - FiveHands - Sarcoma - DragonForce - MedusaLocker - Mimic - Loki","Discovery","https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*advanced_ip_scanner_console.exe*",".{0,1000}advanced_ip_scanner_console\.exe.{0,1000}","greyware_tool_keyword","advanced-ip-scanner","The program shows all network devices. gives you access to shared folders. provides remote control of computers (via RDP and Radmin) and can even remotely switch computers off. It is easy to use and runs as a portable edition (abused by TA)","T1135 - T1021 - T1016 - T1046","TA0007 - TA0043","N/A","MAZE - BlackSuit - Royal - Akira - LockBit - Diavol - GoGoogle - INC Ransom - Hive - ZolaConti2 - Darkside - UNC24653 - Egregor4 - Hades - Evilcorp5 - REvil6 - Ryuk - UNC18787 - UNC24477 - Vice Society - FiveHands - Sarcoma - DragonForce - MedusaLocker - Mimic - Loki","Discovery","https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*advanced_port_scanner.exe*",".{0,1000}advanced_port_scanner\.exe.{0,1000}","greyware_tool_keyword","advanced port scanner","port scanner tool abused by ransomware actors","T1135 - T1021 - T1016 - T1046","TA0007 - TA0043","N/A","Dispossessor - LockBit - BianLian - PYSA - Trigona - EvilCorp* - Fog - Scattered Spider* - INDRIK SPIDER - Medusa Locker","Discovery","https://www.advanced-port-scanner.com/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*advanced_port_scanner_console.exe*",".{0,1000}advanced_port_scanner_console\.exe.{0,1000}","greyware_tool_keyword","advanced port scanner","port scanner tool abused by ransomware actors","T1135 - T1021 - T1016 - T1046","TA0007 - TA0043","N/A","Dispossessor - LockBit - BianLian - PYSA - Trigona - EvilCorp* - Fog - Scattered Spider* - INDRIK SPIDER - Medusa Locker","Discovery","https://www.advanced-port-scanner.com/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*AeroAdmin_2.exe*",".{0,1000}AeroAdmin_2\.exe.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*agent.fleetdeck.io/*?win*",".{0,1000}agent\.fleetdeck\.io\/.{0,1000}\?win.{0,1000}","greyware_tool_keyword","fleetdeck","FleetDeck is a Remote Desktop & Virtual Terminal solution tailored for techs to  manage large fleets of computers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://fleetdeck.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*agent01.xeox.com*",".{0,1000}agent01\.xeox\.com.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*agent-api.atera.com*",".{0,1000}agent\-api\.atera\.com.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*agents.level.io*",".{0,1000}agents\.level\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*agrinman/tap/tunnelto*",".{0,1000}agrinman\/tap\/tunnelto.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*agrinman/tunnelto*",".{0,1000}agrinman\/tunnelto.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*alt.meshcentral.com*",".{0,1000}alt\.meshcentral\.com.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*amalshaji/portr*",".{0,1000}amalshaji\/portr.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*amalshaji/taps/portr*",".{0,1000}amalshaji\/taps\/portr.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*amidaware/tacticalrmm*",".{0,1000}amidaware\/tacticalrmm.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*anderspitman/SirTunnel*",".{0,1000}anderspitman\/SirTunnel.{0,1000}","greyware_tool_keyword","SirTunnel","SirTunnel enables you to securely expose a webserver running on your computer to a public URL using HTTPS.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/anderspitman/SirTunnel","1","1","N/A","N/A","10","10","1404","119","2024-03-24T20:15:50Z","2020-09-23T00:15:26Z"
"*angryip/ipscan*",".{0,1000}angryip\/ipscan.{0,1000}","greyware_tool_keyword","ipscan","Angry IP Scanner - fast and friendly network scanner - abused by a lot ransomware actors","T1046 - T1040 - T1018","TA0007 - TA0009","N/A","Phobos - BERSERK BEAR","Discovery","https://github.com/angryip/ipscan","1","1","N/A","N/A","7","10","4333","743","2024-11-23T19:03:47Z","2011-06-28T20:58:48Z"
"*AnydeskBackdoor.ps1*",".{0,1000}AnydeskBackdoor\.ps1.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://github.com/Ab4y98/VerySimpleAnyDeskBackdoor/blob/main/AnydeskBackdoor.ps1","1","1","simple backdoor with anydesk","N/A","10","1","1","0","2023-12-14T09:58:30Z","2023-12-05T22:08:51Z"
"*AnyplaceControlInstall.exe*",".{0,1000}AnyplaceControlInstall\.exe.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*api.btunnel.in*",".{0,1000}api\.btunnel\.in.{0,1000}","greyware_tool_keyword","btunnel","Btunnel is a publicly accessible reverse proxy","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://www.btunnel.in","1","1","N/A","N/A","9","8","N/A","N/A","N/A","N/A"
"*api.cyberghostvpn.com*",".{0,1000}api\.cyberghostvpn\.com.{0,1000}","greyware_tool_keyword","CyberGhost VPN","External VPN usage within coporate network","T1567 - T1090","TA0003 - TA0005 - TA0009 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://www.cyberghostvpn.com/","1","1","#VPN","N/A","9","8","N/A","N/A","N/A","N/A"
"*api.dataplicity.com*",".{0,1000}api\.dataplicity\.com.{0,1000}","greyware_tool_keyword","Dataplicity","enables connecting local systems to dataplicity cloud for remotely accessing them over the internet.","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/wildfoundry/dataplicity-agent","1","1","N/A","N/A","9","2","167","32","2024-06-10T20:17:43Z","2016-07-27T14:23:01Z"
"*api.freefilesync.org*",".{0,1000}api\.freefilesync\.org.{0,1000}","greyware_tool_keyword","freefilesync","freefilesync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","LockBit","Data Exfiltration","https://freefilesync.org/download.php","1","1","#filehostingservice","N/A","9","10","N/A","N/A","N/A","N/A"
"*api.gofile.io/getServer*",".{0,1000}api\.gofile\.io\/getServer.{0,1000}","greyware_tool_keyword","gofile.io","legitimate service abused by lots of stealer to exfiltrate data","T1567.002","TA0010","N/A","Hive - Royal - LockBit - Vice Society - BlackSuit - Conti","Data Exfiltration","https://gofile.io","1","1","#filehostingservice","N/A","8","10","N/A","N/A","N/A","N/A"
"*api.localxpose.io*",".{0,1000}api\.localxpose\.io.{0,1000}","greyware_tool_keyword","localxpose","LocalXpose is a reverse proxy that enables you to expose your localhost to the internet","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://localxpose.io/","1","1","N/A","N/A","10","1","N/A","N/A","N/A","N/A"
"*api.remot3.it*",".{0,1000}api\.remot3\.it.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/installer","1","1","N/A","N/A","10","10","24","9","2024-04-17T00:45:45Z","2019-01-29T21:06:02Z"
"*api.surfshark.com/*",".{0,1000}api\.surfshark\.com\/.{0,1000}","greyware_tool_keyword","surfshark VPN","usage of surfsharkVPN client","T1090 - T1573","TA0005 - TA010","N/A","N/A","Defense Evasion","","1","1","N/A","N/A","7","8","N/A","N/A","N/A","N/A"
"*api.telegram.org*",".{0,1000}api\.telegram\.org.{0,1000}","greyware_tool_keyword","telegram","telegram API usage -given the increasing adoption of Telegram by malware for command and control (C2) operations. it's essential to monitor and restrict its usage within corporate networks and on company devices","T1071.004 - T1102 - T1047","TA0011 - TA0002 - TA0005","N/A","Gamaredon","C2","api.telegram.org","0","1","N/A","High False positive Risk !","1","9","N/A","N/A","N/A","N/A"
"*api/v1/fleet/sso/callback*",".{0,1000}api\/v1\/fleet\/sso\/callback.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*api01.remot3.it*",".{0,1000}api01\.remot3\.it.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/installer","1","1","N/A","N/A","10","10","24","9","2024-04-17T00:45:45Z","2019-01-29T21:06:02Z"
"*api-telemetry.servers.getgo.com*",".{0,1000}api\-telemetry\.servers\.getgo\.com.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*asapi.aweray.net*",".{0,1000}asapi\.aweray\.net.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*asse.rel.tunnels.api.visualstudio.com*",".{0,1000}asse\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*assist.zoho.com*",".{0,1000}assist\.zoho\.com.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*as-tk.aweray.com*",".{0,1000}as\-tk\.aweray\.com.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*as-tk.aweray.com/track*",".{0,1000}as\-tk\.aweray\.com\/track.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ataylor32/duckdns-powershell*",".{0,1000}ataylor32\/duckdns\-powershell.{0,1000}","greyware_tool_keyword","duckdns.org","A simple C# DuckDNS updater - free dynamic DNS hosted on AWS - often used by threat actors for contacting C2","T1568.002 - T1071.001","TA0011 - TA0005","N/A","N/A","Defense Evasion","https://www.duckdns.org/install.jsp","1","1","N/A","N/A","5","10","N/A","N/A","N/A","N/A"
"*atera_del.bat*",".{0,1000}atera_del\.bat.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*atera_del2.bat*",".{0,1000}atera_del2\.bat.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*auc1.rel.tunnels.api.visualstudio.com*",".{0,1000}auc1\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*aue.rel.tunnels.api.visualstudio.com*",".{0,1000}aue\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*aue.rel.tunnels.api.visualstudio.com*",".{0,1000}aue\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","vscode","built-in port forwarding. This feature allows you to share locally running services over the internet to other people and devices.","T1090 - T1003 - T1571","TA0010 - TA0002 - TA0009","N/A","N/A","C2","https://twitter.com/code/status/1699869087071899669","0","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*aue-data.rel.tunnels.api.visualstudio.com*",".{0,1000}aue\-data\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","vscode","built-in port forwarding. This feature allows you to share locally running services over the internet to other people and devices.","T1090 - T1003 - T1571","TA0010 - TA0002 - TA0009","N/A","N/A","C2","https://twitter.com/code/status/1699869087071899669","0","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*auth11.aeroadmin.com*",".{0,1000}auth11\.aeroadmin\.com.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AutoHotkey/Ahk2Exe*",".{0,1000}AutoHotkey\/Ahk2Exe.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*AutoHotkey/AutoHotkey*",".{0,1000}AutoHotkey\/AutoHotkey.{0,1000}","greyware_tool_keyword","AutoHotkey","AutoHotkey - macro-creation and automation-oriented scripting utility for Windows","T1056.001 - T1027 - T1059.001 - T1140","TA0005 - TA0002","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/AutoHotkey","1","1","N/A","abused by multiple threat actors https://thehackernews.com/2024/06/darkgate-malware-replaces-autoit-with.html - False positives expected","6","10","9869","983","2025-02-02T21:27:58Z","2009-11-25T11:08:21Z"
"*AutoHotkeySC.bin*",".{0,1000}AutoHotkeySC\.bin.{0,1000}","greyware_tool_keyword","AutoHotkey","AutoHotkey - macro-creation and automation-oriented scripting utility for Windows","T1056.001 - T1027 - T1059.001 - T1140","TA0005 - TA0002","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/AutoHotkey","1","1","N/A","abused by multiple threat actors https://thehackernews.com/2024/06/darkgate-malware-replaces-autoit-with.html - False positives expected","6","10","9869","983","2025-02-02T21:27:58Z","2009-11-25T11:08:21Z"
"*auvik.agent.exe*",".{0,1000}auvik\.agent\.exe.{0,1000}","greyware_tool_keyword","auvik","cloud-based network management software","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.auvik.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AuvikService.exe*",".{0,1000}AuvikService\.exe.{0,1000}","greyware_tool_keyword","auvik","cloud-based network management software","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.auvik.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Aweray_Remote.exe*",".{0,1000}Aweray_Remote\.exe.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*awerayimg.com*",".{0,1000}awerayimg\.com.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AzureADConnectAuthenticationAgentService.exe*",".{0,1000}AzureADConnectAuthenticationAgentService\.exe.{0,1000}","greyware_tool_keyword","AADInternals","AADInternals PowerShell module for administering Azure AD and Office 365","T1583 - T1558 - T1078 - T1136 - T1087 - T1114 - T1566 - T1056 - T1199 - T1098 - T1649 - T1621 - T1649","TA0006 - TA0003 - TA0004 - TA0005 - TA0007 - TA0009 - TA0011","N/A","APT29 - COZY BEAR","Exploitation tool","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","9","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*b4ldr/nse-scripts*",".{0,1000}b4ldr\/nse\-scripts.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*berstend/hypertunnel*",".{0,1000}berstend\/hypertunnel.{0,1000}","greyware_tool_keyword","hypertunnel","Expose any local TCP/IP service on the internet","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/berstend/hypertunnel","1","1","N/A","N/A","10","10","246","47","2022-12-08T19:13:24Z","2018-06-11T05:29:58Z"
"*beyondcode/expose*",".{0,1000}beyondcode\/expose.{0,1000}","greyware_tool_keyword","expose","tunneling service - written in pure PHP","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/beyondcode/expose","1","1","N/A","N/A","10","10","4344","271","2025-02-28T13:35:11Z","2020-04-14T19:18:38Z"
"*bfleegjcoffelppfmadimianphbcdjkb*",".{0,1000}bfleegjcoffelppfmadimianphbcdjkb.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","#browser_extensionid","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*bit.ly/2alyerp*",".{0,1000}bit\.ly\/2alyerp.{0,1000}","greyware_tool_keyword","Dataplicity","enables connecting local systems to dataplicity cloud for remotely accessing them over the internet.","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/wildfoundry/dataplicity-agent","1","1","N/A","N/A","9","2","167","32","2024-06-10T20:17:43Z","2016-07-27T14:23:01Z"
"*bluekeepscanner.exe*",".{0,1000}bluekeepscanner\.exe.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner and Earth Lusca Operations Tools and commands","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf https://github.com/vletoux/pingcastle","1","1","N/A","N/A","10","","N/A","","",""
"*bomgar-rdp.exe*",".{0,1000}bomgar\-rdp\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*boot.net.anydesk.com*",".{0,1000}boot\.net\.anydesk\.com.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","1","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*bored-tunnel-client_Windows_x86_64.*",".{0,1000}bored\-tunnel\-client_Windows_x86_64\..{0,1000}","greyware_tool_keyword","btunnel","Btunnel is a publicly accessible reverse proxy","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://www.btunnel.in","1","1","N/A","N/A","9","8","N/A","N/A","N/A","N/A"
"*boringproxy/boringproxy*",".{0,1000}boringproxy\/boringproxy.{0,1000}","greyware_tool_keyword","boringproxy","Simple tunneling reverse proxy with a fast web UI and auto HTTPS. Designed for self-hosters.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/boringproxy/boringproxy","1","1","N/A","N/A","10","10","1258","119","2024-07-06T10:13:37Z","2020-09-26T21:58:07Z"
"*boringproxy_db.json*",".{0,1000}boringproxy_db\.json.{0,1000}","greyware_tool_keyword","boringproxy","Simple tunneling reverse proxy with a fast web UI and auto HTTPS. Designed for self-hosters.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/boringproxy/boringproxy","1","1","N/A","N/A","10","10","1258","119","2024-07-06T10:13:37Z","2020-09-26T21:58:07Z"
"*brimstone/rsocks*",".{0,1000}brimstone\/rsocks.{0,1000}","greyware_tool_keyword","rsocks","reverse socks5 client & server","T1090 - T1571 - T1071 - T1095","TA0011 - TA0001 - TA0008","N/A","Scattered Spider*","C2","https://github.com/brimstone/rsocks","1","1","N/A","N/A","10","10","84","30","2020-01-09T20:45:32Z","2018-01-05T03:09:07Z"
"*browser.lol/create*",".{0,1000}browser\.lol\/create.{0,1000}","greyware_tool_keyword","browser.lol","Virtual Browser - Safely visit blocked or risky websites - can be used to bypass network restrictions within a corporate environment","T1071 - T1090 - T1562","TA0005","N/A","N/A","Defense Evasion","https://browser.lol","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*brs.rel.tunnels.api.visualstudio.com*",".{0,1000}brs\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*builds.level.io*",".{0,1000}builds\.level\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*c3pool_miner.bat*",".{0,1000}c3pool_miner\.bat.{0,1000}","greyware_tool_keyword","xmrig","Auto setup scripts and pre-compiled xmr miner for c3pool.com pool","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*c3pool_miner.service*",".{0,1000}c3pool_miner\.service.{0,1000}","greyware_tool_keyword","xmrig","Auto setup scripts and pre-compiled xmr miner for c3pool.com pool","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*c3pool_miner.sh*",".{0,1000}c3pool_miner\.sh.{0,1000}","greyware_tool_keyword","xmrig","Auto setup scripts and pre-compiled xmr miner for c3pool.com pool","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*cdn*.boxcdn.net*",".{0,1000}cdn.{0,1000}\.boxcdn\.net.{0,1000}","greyware_tool_keyword","Box","Attackers have used box to store malicious files and then share them with targets - box can also be used for data exfiltration by attackers","T1567.002 - T1071.001 - T1036 - T1048.002","TA0005 - TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://app.box.com/","1","1","#dnsquery","N/A","6","7","N/A","N/A","N/A","N/A"
"*chat.us.n-able.com*",".{0,1000}chat\.us\.n\-able\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ChromeCookiesView.exe*",".{0,1000}ChromeCookiesView\.exe.{0,1000}","greyware_tool_keyword","ChromeCookiesView","displays the list of all cookies stored by Google Chrome Web browser - abused by attackers","T1539 - T1005 - T1070.004 - T1552.001","TA0006 - TA0008 - TA0009","N/A","Evilnum - MuddyWater","Credential Access","https://www.nirsoft.net/utils/chrome_cookies_view.html","1","1","N/A","https://documents.trendmicro.com/assets/white_papers/wp_new_muddywater_findings_uncovered.pdf","8","10","N/A","N/A","N/A","N/A"
"*chromecookiesview.zip*",".{0,1000}chromecookiesview\.zip.{0,1000}","greyware_tool_keyword","ChromeCookiesView","displays the list of all cookies stored by Google Chrome Web browser - abused by attackers","T1539 - T1005 - T1070.004 - T1552.001","TA0006 - TA0008 - TA0009","N/A","Evilnum - MuddyWater","Credential Access","https://www.nirsoft.net/utils/chrome_cookies_view.html","1","1","N/A","https://documents.trendmicro.com/assets/white_papers/wp_new_muddywater_findings_uncovered.pdf","8","10","N/A","N/A","N/A","N/A"
"*chromecookiesview-x64.zip*",".{0,1000}chromecookiesview\-x64\.zip.{0,1000}","greyware_tool_keyword","ChromeCookiesView","displays the list of all cookies stored by Google Chrome Web browser - abused by attackers","T1539 - T1005 - T1070.004 - T1552.001","TA0006 - TA0008 - TA0009","N/A","Evilnum - MuddyWater","Credential Access","https://www.nirsoft.net/utils/chrome_cookies_view.html","1","1","N/A","https://documents.trendmicro.com/assets/white_papers/wp_new_muddywater_findings_uncovered.pdf","8","10","N/A","N/A","N/A","N/A"
"*chrome-remote-desktop_current_amd64.deb*",".{0,1000}chrome\-remote\-desktop_current_amd64\.deb.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*chromeremotedesktophost.msi*",".{0,1000}chromeremotedesktophost\.msi.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*client.teamviewer.com*",".{0,1000}client\.teamviewer\.com.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*client-api.aweray.com*",".{0,1000}client\-api\.aweray\.com.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*cloud.telebit.remot*",".{0,1000}cloud\.telebit\.remot.{0,1000}","greyware_tool_keyword","telebit.cloud","Access your devices - Share your stuff (shell from telebit.cloud)","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://telebit.cloud/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*cloudflared-amd64.pkg*",".{0,1000}cloudflared\-amd64\.pkg.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","N/A","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*cloudflared-windows-386.exe*",".{0,1000}cloudflared\-windows\-386\.exe.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","N/A","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*cloudflared-windows-amd64.exe*",".{0,1000}cloudflared\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","N/A","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*cloudflared-windows-amd64.msi*",".{0,1000}cloudflared\-windows\-amd64\.msi.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","N/A","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*cmd/boringproxy*",".{0,1000}cmd\/boringproxy.{0,1000}","greyware_tool_keyword","boringproxy","Simple tunneling reverse proxy with a fast web UI and auto HTTPS. Designed for self-hosters.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/boringproxy/boringproxy","1","1","N/A","N/A","10","10","1258","119","2024-07-06T10:13:37Z","2020-09-26T21:58:07Z"
"*cmd/crowbard/*",".{0,1000}cmd\/crowbard\/.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","N/A","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*code.onedev.io/SoftEther/VPN.git*",".{0,1000}code\.onedev\.io\/SoftEther\/VPN\.git.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*codeload.github.com/*",".{0,1000}codeload\.github\.com\/.{0,1000}","greyware_tool_keyword","github","Github executables download initiated - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*commanderupdate.fleetdeck.io*",".{0,1000}commanderupdate\.fleetdeck\.io.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*comserver.corporate.beanywhere.com*",".{0,1000}comserver\.corporate\.beanywhere\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*control.*.logmeinrescue.com*",".{0,1000}control\..{0,1000}\.logmeinrescue\.com.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*control.rsc-app*.logmeinrescue.com",".{0,1000}control\.rsc\-app.{0,1000}\.logmeinrescue\.com","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*controlserver.anyviewer.com*",".{0,1000}controlserver\.anyviewer\.com.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*crash.syncthing.net*",".{0,1000}crash\.syncthing\.net.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*curl*.interact.sh*",".{0,1000}curl.{0,1000}\.interact\.sh.{0,1000}","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C3","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*cwn-log-collector-production-clone.*.elasticbeanstalk.com*",".{0,1000}cwn\-log\-collector\-production\-clone\..{0,1000}\.elasticbeanstalk\.com.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*CyberGhost.exe*",".{0,1000}CyberGhost\.exe.{0,1000}","greyware_tool_keyword","CyberGhost VPN","External VPN usage within coporate network","T1567 - T1090","TA0003 - TA0005 - TA0009 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://www.cyberghostvpn.com/","1","1","#VPN","N/A","9","8","N/A","N/A","N/A","N/A"
"*CyberGhost.Service.exe*",".{0,1000}CyberGhost\.Service\.exe.{0,1000}","greyware_tool_keyword","CyberGhost VPN","External VPN usage within coporate network","T1567 - T1090","TA0003 - TA0005 - TA0009 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://www.cyberghostvpn.com/","1","1","#VPN","N/A","9","8","N/A","N/A","N/A","N/A"
"*CyberGhostVPNSetup.exe*",".{0,1000}CyberGhostVPNSetup\.exe.{0,1000}","greyware_tool_keyword","CyberGhost VPN","External VPN usage within coporate network","T1567 - T1090","TA0003 - TA0005 - TA0009 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://www.cyberghostvpn.com/","1","1","#VPN","N/A","9","8","N/A","N/A","N/A","N/A"
"*damewareagent.msi*",".{0,1000}damewareagent\.msi.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*damewareremoteeverywhereagent.exe*",".{0,1000}damewareremoteeverywhereagent\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*damewareremoteeverywhereconsole.exe*",".{0,1000}damewareremoteeverywhereconsole\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*daps94/SirTunnel*",".{0,1000}daps94\/SirTunnel.{0,1000}","greyware_tool_keyword","SirTunnel","SirTunnel enables you to securely expose a webserver running on your computer to a public URL using HTTPS.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/anderspitman/SirTunnel","1","1","N/A","N/A","10","10","1404","119","2024-03-24T20:15:50Z","2020-09-23T00:15:26Z"
"*dashboard.tunnelmole.com*",".{0,1000}dashboard\.tunnelmole\.com.{0,1000}","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*-data.rel.tunnels.api.visualstudio.com*",".{0,1000}\-data\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","vscode","built-in port forwarding. This feature allows you to share locally running services over the internet to other people and devices.","T1090 - T1003 - T1571","TA0010 - TA0002 - TA0009","N/A","N/A","C2","https://twitter.com/code/status/1699869087071899669","0","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*data.syncthing.net*",".{0,1000}data\.syncthing\.net.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*device.remote.it*",".{0,1000}device\.remote\.it.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/installer","1","1","N/A","N/A","10","10","24","9","2024-04-17T00:45:45Z","2019-01-29T21:06:02Z"
"*d-h.st/users/powertool*",".{0,1000}d\-h\.st\/users\/powertool.{0,1000}","greyware_tool_keyword","Powertool","tool abused by threat actors to desactive Antivirus","T1562.001 - T1089 - T1562.009","TA0005","N/A","Play - Dispossessor","Defense Evasion","https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*disk2vhd.exe*",".{0,1000}disk2vhd\.exe.{0,1000}","greyware_tool_keyword","Disk2vhd","convert physical disks into Virtual Hard Disk (VHD) files -attackers can leverage it for Collection","T1560.002 - T1012 - T1560.003","TA0005 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","8","4","N/A","N/A","N/A","N/A"
"*Disk2vhd.zip*",".{0,1000}Disk2vhd\.zip.{0,1000}","greyware_tool_keyword","Disk2vhd","convert physical disks into Virtual Hard Disk (VHD) files -attackers can leverage it for Collection","T1560.002 - T1012 - T1560.003","TA0005 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","8","4","N/A","N/A","N/A","N/A"
"*disk2vhd64.exe*",".{0,1000}disk2vhd64\.exe.{0,1000}","greyware_tool_keyword","Disk2vhd","convert physical disks into Virtual Hard Disk (VHD) files -attackers can leverage it for Collection","T1560.002 - T1012 - T1560.003","TA0005 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","8","4","N/A","N/A","N/A","N/A"
"*dl.wireshark.org*",".{0,1000}dl\.wireshark\.org.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*donate.ssl.xmrig.com*",".{0,1000}donate\.ssl\.xmrig\.com.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*donate.v2.xmrig.com:3333*",".{0,1000}donate\.v2\.xmrig\.com\:3333.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*donate.xmrig.com*",".{0,1000}donate\.xmrig\.com.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*download.anydesk.com*",".{0,1000}download\.anydesk\.com.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt","RMM","https://anydesk.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.cyberghostvpn.com*",".{0,1000}download\.cyberghostvpn\.com.{0,1000}","greyware_tool_keyword","CyberGhost VPN","External VPN usage within coporate network","T1567 - T1090","TA0003 - TA0005 - TA0009 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://www.cyberghostvpn.com/","1","1","#VPN","N/A","9","8","N/A","N/A","N/A","N/A"
"*download.filezilla-project.org*",".{0,1000}download\.filezilla\-project\.org.{0,1000}","greyware_tool_keyword","FileZilla","FileZilla admintool used by threat actors for persistence and data exfiltration","T1505 - T1041","TA0003 - TA0009 -TA0010","N/A","Dispossessor - Akira - Karakurt - AvosLocker - LockBit - Nokoyawa - Diavol - Scattered Spider* - Unit 29155","Data Exfiltration","https://filezilla-project.org/","1","1","N/A","PUA risk of legitimate usage","5","7","N/A","N/A","N/A","N/A"
"*download.global.mspa.n-able.com/*",".{0,1000}download\.global\.mspa\.n\-able\.com\/.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.radmin.com*",".{0,1000}download\.radmin\.com.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.radmin-vpn.com*",".{0,1000}download\.radmin\-vpn\.com.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.remotepc.com*",".{0,1000}download\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.teamviewer.com.cdn.cloudflare.net*",".{0,1000}download\.teamviewer\.com\.cdn\.cloudflare\.net.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*download.wireguard.com/windows-client/*",".{0,1000}download\.wireguard\.com\/windows\-client\/.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","Defense Evasion","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*downloads.nordcdn.com/apps/vpn-extension/*",".{0,1000}downloads\.nordcdn\.com\/apps\/vpn\-extension\/.{0,1000}","greyware_tool_keyword","NordVPN","OVPN configuration for nordvpn accessed within corporate network","T1090.003 - T1133 - T1572","TA0003 - TA0001 - TA0011 - TA0010 - TA0005","N/A","N/A","Data Exfiltration","https://nordvpn.com","1","1","#VPN","N/A","8","10","N/A","N/A","N/A","N/A"
"*downloads.remote.it/remoteit/install_agent.sh*",".{0,1000}downloads\.remote\.it\/remoteit\/install_agent\.sh.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/installer","1","1","N/A","N/A","10","10","24","9","2024-04-17T00:45:45Z","2019-01-29T21:06:02Z"
"*downloads.surfshark.com*",".{0,1000}downloads\.surfshark\.com.{0,1000}","greyware_tool_keyword","surfshark VPN","usage of surfsharkVPN client","T1090 - T1573","TA0005 - TA010","N/A","N/A","Defense Evasion","","1","1","N/A","N/A","7","8","N/A","N/A","N/A","N/A"
"*downloads.zohocdn.com*",".{0,1000}downloads\.zohocdn\.com.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*downloads.zohodl.com.cn*",".{0,1000}downloads\.zohodl\.com\.cn.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*downloads2.surfshark.com*",".{0,1000}downloads2\.surfshark\.com.{0,1000}","greyware_tool_keyword","surfshark VPN","usage of surfsharkVPN client","T1090 - T1573","TA0005 - TA010","N/A","N/A","Defense Evasion","","1","1","N/A","N/A","7","8","N/A","N/A","N/A","N/A"
"*ekzhang/bore*",".{0,1000}ekzhang\/bore.{0,1000}","greyware_tool_keyword","bore","bore is a simple CLI tool for making tunnels to localhost","T1090 - T1090.003 - T1572 - T1572.001","TA0042 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/ekzhang/bore","1","1","N/A","N/A","10","10","9408","399","2025-01-10T18:31:56Z","2022-04-04T02:47:54Z"
"*ekzhang/sshx*",".{0,1000}ekzhang\/sshx.{0,1000}","greyware_tool_keyword","sshx","Fast collaborative live terminal sharing over the web","T1021.004 - T1041 - T1059 - T1071.001","TA0002 - TA0009 - TA0011 - TA0010","N/A","N/A","C2","https://github.com/ekzhang/sshx","1","1","N/A","N/A","10","10","6284","208","2025-02-12T20:40:30Z","2022-02-12T23:29:33Z"
"*elddy/NimScan*",".{0,1000}elddy\/NimScan.{0,1000}","greyware_tool_keyword","NimScan","Really fast port scanner (With filtered option - Windows support only)","T1046","TA0007","N/A","N/A","Discovery","https://github.com/elddy/NimScan","1","1","N/A","N/A","8","4","389","38","2022-02-10T13:23:02Z","2020-08-12T14:20:46Z"
"*eun1.rel.tunnels.api.visualstudio.com*",".{0,1000}eun1\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*euw.rel.tunnels.api.visualstudio.com*",".{0,1000}euw\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*eval-*.beyondtrustcloud.com*",".{0,1000}eval\-.{0,1000}\.beyondtrustcloud\.com.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*EvanMcBroom/lsa-whisperer*",".{0,1000}EvanMcBroom\/lsa\-whisperer.{0,1000}","greyware_tool_keyword","lsa-whisperer","Tools for interacting with authentication packages using their individual message protocols","T1556.002 - T1003.001","TA0006 - TA0005","N/A","N/A","Credential Access","https://github.com/EvanMcBroom/lsa-whisperer","1","1","N/A","N/A","6","4","307","28","2025-03-01T00:12:15Z","2022-08-04T14:35:45Z"
"*f38fg.tunnelmole.net*",".{0,1000}f38fg\.tunnelmole\.net.{0,1000}","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*fasmide/remotemoe*",".{0,1000}fasmide\/remotemoe.{0,1000}","greyware_tool_keyword","remotemoe","remotemoe is a software daemon for exposing ad-hoc services to the internet without having to deal with the regular network stuff such as configuring VPNs - changing firewalls - or adding port forwards","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/fasmide/remotemoe","1","1","N/A","N/A","10","10","284","32","2024-06-03T14:00:47Z","2020-06-11T07:41:03Z"
"*fatedier/frp*",".{0,1000}fatedier\/frp.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","N/A","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*fee.xmrig.com*",".{0,1000}fee\.xmrig\.com.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*feedback.cyberghostvpn.com*",".{0,1000}feedback\.cyberghostvpn\.com.{0,1000}","greyware_tool_keyword","CyberGhost VPN","External VPN usage within coporate network","T1567 - T1090","TA0003 - TA0005 - TA0009 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://www.cyberghostvpn.com/","1","1","#VPN","N/A","9","8","N/A","N/A","N/A","N/A"
"*File Shredder setup.exe*",".{0,1000}File\sShredder\ssetup\.exe.{0,1000}","greyware_tool_keyword","Shredder","File Shredder is FREE and powerfull aplication to shred and permanently remove unwanted files from your computer beyond recovery","T1070 - T1485 - T1565.001","TA0005 - TA0040","N/A","N/A","Defense Evasion","https://www.fileshredder.org/","1","1","N/A","N/A","7","8","N/A","N/A","N/A","N/A"
"*File Shredder.exe*",".{0,1000}File\sShredder\.exe.{0,1000}","greyware_tool_keyword","Shredder","File Shredder is FREE and powerfull aplication to shred and permanently remove unwanted files from your computer beyond recovery","T1070 - T1485 - T1565.001","TA0005 - TA0040","N/A","N/A","Defense Evasion","https://www.fileshredder.org/","1","1","N/A","N/A","7","8","N/A","N/A","N/A","N/A"
"*file_shredder_setup.exe*",".{0,1000}file_shredder_setup\.exe.{0,1000}","greyware_tool_keyword","Shredder","File Shredder is FREE and powerfull aplication to shred and permanently remove unwanted files from your computer beyond recovery","T1070 - T1485 - T1565.001","TA0005 - TA0040","N/A","N/A","Defense Evasion","https://www.fileshredder.org/","1","1","N/A","N/A","7","8","N/A","N/A","N/A","N/A"
"*filetransfer.io/upload/*",".{0,1000}filetransfer\.io\/upload\/.{0,1000}","greyware_tool_keyword","filetransfer.io","uploading to filetransfer.io","T1105 - T1021 - T1560.003 - T1071.001 - T1071.002","TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://filetransfer.io","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*fleetdeck.io/prototype3/commander_svc*",".{0,1000}fleetdeck\.io\/prototype3\/commander_svc.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*fleetdeck_agent.exe*",".{0,1000}fleetdeck_agent\.exe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*fleetdeck_agent_svc.exe*",".{0,1000}fleetdeck_agent_svc\.exe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*fleetdeck_commander_launcher.exe*",".{0,1000}fleetdeck_commander_launcher\.exe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*fleetdeck_commander_svc.exe*",".{0,1000}fleetdeck_commander_svc\.exe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*fleetdeck_installer.exe*",".{0,1000}fleetdeck_installer\.exe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*frpc_windows_amd64.exe*",".{0,1000}frpc_windows_amd64\.exe.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","N/A","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*frpc_windows_arm64.exe*",".{0,1000}frpc_windows_arm64\.exe.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","N/A","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*frps_windows_amd64.exe*",".{0,1000}frps_windows_amd64\.exe.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","N/A","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*frps_windows_arm64.exe*",".{0,1000}frps_windows_arm64\.exe.{0,1000}","greyware_tool_keyword","frp","A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.","T1572 - T1090 - T1599","TA0010 - TA0040","N/A","N/A","Data Exfiltration","https://github.com/fatedier/frp","1","1","N/A","N/A","10","10","90993","13760","2025-02-12T04:30:37Z","2015-12-21T15:24:59Z"
"*gateway.zohoassist.com*",".{0,1000}gateway\.zohoassist\.com.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*geo.netsupportsoftware.com*",".{0,1000}geo\.netsupportsoftware\.com.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Gerenios/AADInternals*",".{0,1000}Gerenios\/AADInternals.{0,1000}","greyware_tool_keyword","AADInternals","AADInternals PowerShell module for administering Azure AD and Office 365","T1583 - T1558 - T1078 - T1136 - T1087 - T1114 - T1566 - T1056 - T1199 - T1098 - T1649 - T1621 - T1649","TA0006 - TA0003 - TA0004 - TA0005 - TA0007 - TA0009 - TA0011","N/A","APT29 - COZY BEAR","Exploitation tool","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","9","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*getcroc.schollz.com*",".{0,1000}getcroc\.schollz\.com.{0,1000}","greyware_tool_keyword","croc","croc is a tool that allows any two computers to simply and securely transfer files and folders","T1567.002 - T1090.002 - T1573.002 - T1102.003","TA0010 - TA0005 - TA0008 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/schollz/croc","1","1","N/A","N/A","8","10","28838","1143","2025-02-25T09:03:12Z","2017-10-17T15:20:18Z"
"*ghcr.io/agrinman/tunnelto*",".{0,1000}ghcr\.io\/agrinman\/tunnelto.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*ghcr.io/ao-space/gt:client-dev*",".{0,1000}ghcr\.io\/ao\-space\/gt\:client\-dev.{0,1000}","greyware_tool_keyword","gt","Fast WebSocket(s)/HTTP(s)/TCP relay proxy for making tunnels to localhost.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ao-space/gt","1","1","N/A","N/A","10","10","127","36","2024-10-30T00:37:47Z","2021-11-29T03:09:56Z"
"*ghcr.io/ao-space/gt:server-dev*",".{0,1000}ghcr\.io\/ao\-space\/gt\:server\-dev.{0,1000}","greyware_tool_keyword","gt","Fast WebSocket(s)/HTTP(s)/TCP relay proxy for making tunnels to localhost.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ao-space/gt","1","1","N/A","N/A","10","10","127","36","2024-10-30T00:37:47Z","2021-11-29T03:09:56Z"
"*github*/xmrig/xmrig*",".{0,1000}github.{0,1000}\/xmrig\/xmrig.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*github*ao-space/gt*",".{0,1000}github.{0,1000}ao\-space\/gt.{0,1000}","greyware_tool_keyword","gt","Fast WebSocket(s)/HTTP(s)/TCP relay proxy for making tunnels to localhost.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ao-space/gt","1","1","N/A","N/A","10","10","127","36","2024-10-30T00:37:47Z","2021-11-29T03:09:56Z"
"*github*koding/tunnel*",".{0,1000}github.{0,1000}koding\/tunnel.{0,1000}","greyware_tool_keyword","tunnel","Tunnel is a server/client package that enables to proxy public connections to your local machine over a tunnel connection from the local machine to the public server. What this means is, you can share your localhost even if it doesn't have a Public IP or if it's not reachable from outside","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/koding/tunnel","1","1","N/A","N/A","10","10","327","72","2023-10-20T13:43:58Z","2015-05-28T07:26:42Z"
"*github.com*/jprq/releases/download/*",".{0,1000}github\.com.{0,1000}\/jprq\/releases\/download\/.{0,1000}","greyware_tool_keyword","jprq","expose TCP protocols such as HTTP - SSH etc. Any server!","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/azimjohn/jprq","1","1","N/A","N/A","10","10","1260","175","2025-01-25T10:39:59Z","2020-04-18T10:12:42Z"
"*github.com/tailscale*",".{0,1000}github\.com\/tailscale.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*gitlab.com/SoftEther/VPN.git*",".{0,1000}gitlab\.com\/SoftEther\/VPN\.git.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*global.rel.tunnels.api.visualstudio.com*",".{0,1000}global\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*global.rel.tunnels.api.visualstudio.com*",".{0,1000}global\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","vscode","Starts a reverse connection over global.rel.tunnels.api.visualstudio.com via websockets","T1090.003 - T1059.001 - T1071.001","TA0011 - TA0002","N/A","N/A","C2","https://badoption.eu/blog/2023/01/31/code_c2.html","0","1","N/A","risk of False positive","10","10","N/A","N/A","N/A","N/A"
"*go-gost/gost*",".{0,1000}go\-gost\/gost.{0,1000}","greyware_tool_keyword","gost","GO Simple Tunnel - a simple tunnel written in golang","T1572","TA0011 - TA0003","N/A","Dispossessor - EMBER BEAR","C2","https://github.com/go-gost/gost","1","1","N/A","N/A","10","10","4729","550","2025-02-18T15:35:15Z","2020-02-12T14:58:08Z"
"*GoodSync-vsub-2Go-Setup.exe*",".{0,1000}GoodSync\-vsub\-2Go\-Setup\.exe.{0,1000}","greyware_tool_keyword","Goodsync","GoodSync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","N/A","Data Exfiltration","https://www.goodsync.com/","1","1","N/A","portable version","9","10","N/A","N/A","N/A","N/A"
"*google-chrome-stable_current_amd64.deb*",".{0,1000}google\-chrome\-stable_current_amd64\.deb.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*GoTo MyPC Installer.exe*",".{0,1000}GoTo\sMyPC\sInstaller\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*gtfobins*",".{0,1000}gtfobins.{0,1000}","greyware_tool_keyword","gtfobins","GTFOBins is a curated list of Unix binaries that can used to bypass local security restrictions in misconfigured systems malicious use of legitimate binaries","T1059 - T1068  -  T1136","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://gtfobins.github.io/","1","1","#linux","high false positive risks - low signal","2","5","N/A","N/A","N/A","N/A"
"*hackforums.net/*",".{0,1000}hackforums\.net\/.{0,1000}","greyware_tool_keyword","hackforums.net","Hack Forums - a well-known online community frequently referenced in various pieces of malicious code","T1588.003","TA0011","N/A","N/A","Exploitation tool","hackforums.net","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*homeassistant.local:8123*",".{0,1000}homeassistant\.local\:8123.{0,1000}","greyware_tool_keyword","homeway.io","Expose local servers to the internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://homeway.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*http*.sslip.io*",".{0,1000}http.{0,1000}\.sslip\.io.{0,1000}","greyware_tool_keyword","sslip.io","sslip.io is a DNS server that maps specially-crafted DNS A records to IP addresses e.g. 127-0-0-1.sslip.io maps to 127.0.0.1","T1568.002 - T1048.003","TA0003 - TA0004","N/A","N/A","C2","https://github.com/cunnie/sslip.io","1","1","N/A","letigimate tool abused by threat actor to bypass IP blockage and encrypt traffic","6","10","702","82","2025-01-25T02:58:08Z","2015-08-26T18:43:35Z"
"*http*/agent-api-*.atera.com*",".{0,1000}http.{0,1000}\/agent\-api\-.{0,1000}\.atera\.com.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*http*://localhost:8081*",".{0,1000}http.{0,1000}\:\/\/localhost\:8081.{0,1000}","greyware_tool_keyword","AlanFramework","Alan Framework is a post-exploitation framework useful during red-team activities.","T1055 - T1071 - T1060 - T1560 - T1021 - T1005 - T1018","TA0002 - TA0005 - TA0011 - TA0008 - TA0010","N/A","N/A","C2","https://github.com/enkomio/AlanFramework","1","1","N/A","N/A","10","10","469","71","2024-01-24T20:30:39Z","2021-01-26T22:56:50Z"
"*http://*.interact.sh*",".{0,1000}http\:\/\/.{0,1000}\.interact\.sh.{0,1000}","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C4","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*http://*.localhost.run*",".{0,1000}http\:\/\/.{0,1000}\.localhost\.run.{0,1000}","greyware_tool_keyword","localhost.run","Put a locally running HTTP HTTPS or TLS app on the internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://localhost.run/","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*http://*.pagekite.me*",".{0,1000}http\:\/\/.{0,1000}\.pagekite\.me.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*http://*.remote.moe/*",".{0,1000}http\:\/\/.{0,1000}\.remote\.moe\/.{0,1000}","greyware_tool_keyword","remotemoe","remotemoe is a software daemon for exposing ad-hoc services to the internet without having to deal with the regular network stuff such as configuring VPNs - changing firewalls - or adding port forwards","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/fasmide/remotemoe","1","1","N/A","N/A","10","10","284","32","2024-06-03T14:00:47Z","2020-06-11T07:41:03Z"
"*http://*.serveo.net*",".{0,1000}http\:\/\/.{0,1000}\.serveo\.net.{0,1000}","greyware_tool_keyword","serveo.net","Expose local servers to the internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://serveo.net","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*http://*.ssi.sh*",".{0,1000}http\:\/\/.{0,1000}\.ssi\.sh.{0,1000}","greyware_tool_keyword","sish","HTTP(S)/WS(S)/TCP Tunnels to localhost using only SSH.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/antoniomika/sish","1","1","N/A","N/A","10","10","4134","317","2025-02-23T16:05:12Z","2019-02-15T15:36:23Z"
"*http://*.trycloudfare.com*",".{0,1000}http\:\/\/.{0,1000}\.trycloudfare\.com.{0,1000}","greyware_tool_keyword","trycloudflare.com","The subdomain .trycloudflare.com is a temporary hostname provided by Cloudflare Tunnel - It allows users to expose local services to the internet without needing to configure port forwarding or a public IP - attackers frequently abuse it for malicious activities","T1071.001 - T1090 - T1583.003 - T1102","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","Phishing","https://www.forcepoint.com/blog/x-labs/asyncrat-python-trycloudflare-malware","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*http://*.tunnelmole.net*",".{0,1000}http\:\/\/.{0,1000}\.tunnelmole\.net.{0,1000}","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*http://*.zrok.io*",".{0,1000}http\:\/\/.{0,1000}\.zrok\.io.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*http://*:9000/restic*",".{0,1000}http\:\/\/.{0,1000}\:9000\/restic.{0,1000}","greyware_tool_keyword","restic","backup program used by threat actors for data exfiltration","T1567","TA0009 - TA0010","N/A","INC Ransom - Lynx","Data Exfiltration","https://github.com/restic/restic","1","1","N/A","N/A","8","10","27784","1585","2025-03-01T01:53:27Z","2014-04-27T14:07:58Z"
"*http://127.0.0.1:18080*",".{0,1000}http\:\/\/127\.0\.0\.1\:18080.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*http://127.0.0.1:2019/id/*",".{0,1000}http\:\/\/127\.0\.0\.1\:2019\/id\/.{0,1000}","greyware_tool_keyword","SirTunnel","SirTunnel enables you to securely expose a webserver running on your computer to a public URL using HTTPS.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/anderspitman/SirTunnel","1","1","N/A","N/A","10","10","1404","119","2024-03-24T20:15:50Z","2020-09-23T00:15:26Z"
"*http://127.0.0.1:3320/-/healthcheck*",".{0,1000}http\:\/\/127\.0\.0\.1\:3320\/\-\/healthcheck.{0,1000}","greyware_tool_keyword","pgrok","Poor man's ngrok - a multi-tenant HTTP/TCP reverse tunnel solution through SSH remote port forwarding","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pgrok/pgrok","1","1","N/A","N/A","10","10","3263","112","2025-03-01T08:52:06Z","2023-03-08T12:43:55Z"
"*http://127.0.0.1:4000*",".{0,1000}http\:\/\/127\.0\.0\.1\:4000.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*http://127.0.0.1:4040/api/logs/*",".{0,1000}http\:\/\/127\.0\.0\.1\:4040\/api\/logs\/.{0,1000}","greyware_tool_keyword","expose","tunneling service - written in pure PHP","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/beyondcode/expose","1","1","N/A","N/A","10","10","4344","271","2025-02-28T13:35:11Z","2020-04-14T19:18:38Z"
"*http://127.0.0.1:4040/api/tunnels*",".{0,1000}http\:\/\/127\.0\.0\.1\:4040\/api\/tunnels.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","N/A","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*http://127.0.0.1:8000/gate.html*",".{0,1000}http\:\/\/127\.0\.0\.1\:8000\/gate\.html.{0,1000}","greyware_tool_keyword","golang_c2","C2 written in Go for red teams aka gorfice2k","T1071 - T1021  -  T1090","TA0011 - TA0008 - TA0010","N/A","N/A","C2","https://github.com/m00zh33/golang_c2","1","1","N/A","N/A","10","10","6","8","2019-03-18T00:46:41Z","2019-03-19T02:39:59Z"
"*http://127.0.0.1:8081*",".{0,1000}http\:\/\/127\.0\.0\.1\:8081.{0,1000}","greyware_tool_keyword","Browser-C2","Post Exploitation agent which uses a browser to do C2 operations.","T1105  - T1102","TA0003 - TA0005 - TA0008","N/A","N/A","C2","https://github.com/0x09AL/Browser-C2","1","1","N/A","N/A","10","10","101","28","2018-05-25T15:12:21Z","2018-05-22T14:33:24Z"
"*http://127.0.0.1:8384*",".{0,1000}http\:\/\/127\.0\.0\.1\:8384.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*http://127.0.0.1:9191*",".{0,1000}http\:\/\/127\.0\.0\.1\:9191.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*http://antibody-software.com/files/wiztreeversion.php*",".{0,1000}http\:\/\/antibody\-software\.com\/files\/wiztreeversion\.php.{0,1000}","greyware_tool_keyword","wiztree","legitimate tool abused by threat actors to obtain network files and directory listings","T1083","TA0007","N/A","Fox Kitten - Faust - Bitlocker - Akira - Cactus - BlackSuit - Royal","Discovery","N/A","1","1","N/A","N/A","3","6","N/A","N/A","N/A","N/A"
"*http://api.guerrillamail.com/ajax.php?*",".{0,1000}http\:\/\/api\.guerrillamail\.com\/ajax\.php\?.{0,1000}","greyware_tool_keyword","guerrillamail","using the API of a disposable email address to use anytime - could be abused by malicious actors","T1071.003","TA0005 - TA0001","N/A","N/A","Defense Evasion","https://www.guerrillamail.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*http://arslan.koding.io/*",".{0,1000}http\:\/\/arslan\.koding\.io\/.{0,1000}","greyware_tool_keyword","tunnel","Tunnel is a server/client package that enables to proxy public connections to your local machine over a tunnel connection from the local machine to the public server. What this means is, you can share your localhost even if it doesn't have a Public IP or if it's not reachable from outside","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/koding/tunnel","1","1","N/A","N/A","10","10","327","72","2023-10-20T13:43:58Z","2015-05-28T07:26:42Z"
"*http://bore.pub/*",".{0,1000}http\:\/\/bore\.pub\/.{0,1000}","greyware_tool_keyword","bore","bore is a simple CLI tool for making tunnels to localhost","T1090 - T1090.003 - T1572 - T1572.001","TA0042 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/ekzhang/bore","1","1","N/A","N/A","10","10","9408","399","2025-01-10T18:31:56Z","2022-04-04T02:47:54Z"
"*http://canarytokens.com/*/*",".{0,1000}http\:\/\/canarytokens\.com\/.{0,1000}\/.{0,1000}","greyware_tool_keyword","canarytokens.com","free honeypot detection tokens but also abused by attacker for payload callback confirmation","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","http://canarytokens.com","1","1","N/A","Out of band interaction domains","10","10","N/A","N/A","N/A","N/A"
"*http://dnslog.cn/*",".{0,1000}http\:\/\/dnslog\.cn\/.{0,1000}","greyware_tool_keyword","dnslog.cn","allows users to create a unique URL to collect and inspect HTTP requests. It is commonly used for debugging webhooks - it can also be abused by attackers for verifying the reachability and effectiveness of their payloads","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","http://dnslog.cn","1","1","N/A","Out of band interaction domains","10","10","N/A","N/A","N/A","N/A"
"*http://dsrt.dyndns.org:8888/uvs_freeupdate_en.htm*",".{0,1000}http\:\/\/dsrt\.dyndns\.org\:8888\/uvs_freeupdate_en\.htm.{0,1000}","greyware_tool_keyword","Universal Virus Sniffer","Universal Virus Sniffer detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","Phobos","Defense Evasion","https://www.majorgeeks.com/files/details/universal_virus_sniffer.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*http://dsrt.dyndns.org:8888/uvs_register_en.htm*",".{0,1000}http\:\/\/dsrt\.dyndns\.org\:8888\/uvs_register_en\.htm.{0,1000}","greyware_tool_keyword","Universal Virus Sniffer","Universal Virus Sniffer detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","Phobos","Defense Evasion","https://www.majorgeeks.com/files/details/universal_virus_sniffer.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*http://get-my-ip.ddns.softether-network.net/ddns/getmyip.ashx*",".{0,1000}http\:\/\/get\-my\-ip\.ddns\.softether\-network\.net\/ddns\/getmyip\.ashx.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*http://get-my-ip.ddns.uxcom.jp/ddns/getmyip.ashx*",".{0,1000}http\:\/\/get\-my\-ip\.ddns\.uxcom\.jp\/ddns\/getmyip\.ashx.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*http://get-my-ip-v6.ddns.softether-network.net/ddns/getmyip.ashx*",".{0,1000}http\:\/\/get\-my\-ip\-v6\.ddns\.softether\-network\.net\/ddns\/getmyip\.ashx.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*http://get-my-ip-v6.ddns.uxcom.jp/ddns/getmyip.ashx*",".{0,1000}http\:\/\/get\-my\-ip\-v6\.ddns\.uxcom\.jp\/ddns\/getmyip\.ashx.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*http://localhost:1337*",".{0,1000}http\:\/\/localhost\:1337.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*http://localhost:1337/previewlogin*",".{0,1000}http\:\/\/localhost\:1337\/previewlogin.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*http://localhost:7681*",".{0,1000}http\:\/\/localhost\:7681.{0,1000}","greyware_tool_keyword","supershell","Supershell is a C2 remote control platform accessed through WEB services. By establishing a reverse SSH tunnel it obtains a fully interactive Shell and supports multi-platform architecture Payload","T1090 - T1059 - T1021","TA0011 - TA0005 - TA0002","N/A","N/A","C2","https://github.com/tdragon6/Supershell","1","1","N/A","N/A","10","10","1537","193","2023-09-26T13:53:55Z","2023-03-25T15:02:43Z"
"*http://local-tailscaled.sock*",".{0,1000}http\:\/\/local\-tailscaled\.sock.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*http://pastie.org/p/*/raw*",".{0,1000}http\:\/\/pastie\.org\/p\/.{0,1000}\/raw.{0,1000}","greyware_tool_keyword","pastie.org","accessing paste raw content","T1119","TA0009","N/A","N/A","Collection","http://pastie.org/","1","1","#PastebinLike","N/A","8","8","N/A","N/A","N/A","N/A"
"*http://pastie.org/pastes/create*",".{0,1000}http\:\/\/pastie\.org\/pastes\/create.{0,1000}","greyware_tool_keyword","pastie.org","sending data to a pastebin","T1567.002","TA0010","N/A","N/A","Data Exfiltration","http://pastie.org/","1","1","#PastebinLike","N/A","8","8","N/A","N/A","N/A","N/A"
"*http://requestbin.net/r/*",".{0,1000}http\:\/\/requestbin\.net\/r\/.{0,1000}","greyware_tool_keyword","requestbin.net","allows users to create a unique URL to collect and inspect HTTP requests. It is commonly used for debugging webhooks - it can also be abused by attackers for verifying the reachability and effectiveness of their payloads","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","http://requestbin.net","1","1","N/A","Out of band interaction domains","10","10","N/A","N/A","N/A","N/A"
"*http://senet.aoi.flets-east.jp/ddns/getmyip.ashx*",".{0,1000}http\:\/\/senet\.aoi\.flets\-east\.jp\/ddns\/getmyip\.ashx.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*http://senet.p-ns.flets-west.jp/ddns/getmyip.ashx*",".{0,1000}http\:\/\/senet\.p\-ns\.flets\-west\.jp\/ddns\/getmyip\.ashx.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*http://senet-flets.v6.softether.co.jp/ddns/getmyip.ashx*",".{0,1000}http\:\/\/senet\-flets\.v6\.softether\.co\.jp\/ddns\/getmyip\.ashx.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*http://support.kaspersky.com/viruses/tdsskiller.xmlt*",".{0,1000}http\:\/\/support\.kaspersky\.com\/viruses\/tdsskiller\.xmlt.{0,1000}","greyware_tool_keyword","TDSKiller","TDSKiller detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","LockBit - Avaddon","Defense Evasion","https://www.majorgeeks.com/files/details/kaspersky_tdsskiller.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*http://tcp.btunnel.in*",".{0,1000}http\:\/\/tcp\.btunnel\.in.{0,1000}","greyware_tool_keyword","btunnel","Btunnel is a publicly accessible reverse proxy","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://www.btunnel.in","1","1","N/A","N/A","9","8","N/A","N/A","N/A","N/A"
"*http://temp.sh/*/*",".{0,1000}https\:\/\/temp\.sh\/.{0,1000}\/.{0,1000}","greyware_tool_keyword","temp.sh","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","Black Basta","Collection","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*http://up.pagekite.net/*",".{0,1000}http\:\/\/up\.pagekite\.net\/.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*http://update.iobit.com/infofiles/iobitunlocker.upt*",".{0,1000}http\:\/\/update\.iobit\.com\/infofiles\/iobitunlocker\.upt.{0,1000}","greyware_tool_keyword","IObitUnlocker","unlocking locked files on Windows systems","T1222 - T1070 - T1485","TA0005 - TA0040","N/A","PLAY","Defense Evasion","https://www.iobit.com/en/iobit-unlocker.php#","1","1","N/A","often used legitimatly - admin tool","5","9","N/A","N/A","N/A","N/A"
"*http://www.advanced-port-scanner.com/checkupdate.php*",".{0,1000}http\:\/\/www\.advanced\-port\-scanner\.com\/checkupdate\.php.{0,1000}","greyware_tool_keyword","advanced port scanner","port scanner tool abused by ransomware actors","T1135 - T1021 - T1016 - T1046","TA0007 - TA0043","N/A","Dispossessor - LockBit - BianLian - PYSA - Trigona - EvilCorp* - Fog - Scattered Spider* - INDRIK SPIDER - Medusa Locker","Discovery","https://www.advanced-port-scanner.com/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*http://www.epoolsoft.com/pchunter/pchunter_free*",".{0,1000}http\:\/\/www\.epoolsoft\.com\/pchunter\/pchunter_free.{0,1000}","greyware_tool_keyword","PCHunter","PCHunter is a toolkit offering deep access to kernel setting - processes - network  and startup configurations. It is designed to detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","LockBit - Conti - 8BASE - TargetCompany - Hive - Qilin","Defense Evasion","https://www.majorgeeks.com/files/details/pc_hunter.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*http://www.epoolsoft.com/PCHunter_Standard*",".{0,1000}http\:\/\/www\.epoolsoft\.com\/PCHunter_Standard.{0,1000}","greyware_tool_keyword","PCHunter","PCHunter is a toolkit offering deep access to kernel setting - processes - network  and startup configurations. It is designed to detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","LockBit - Conti - 8BASE - TargetCompany - Hive - Qilin","Defense Evasion","https://www.majorgeeks.com/files/details/pc_hunter.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*http://www.proxifier.com/distr/last_versions/ProxifierMac*",".{0,1000}http\:\/\/www\.proxifier\.com\/distr\/last_versions\/ProxifierMac.{0,1000}","greyware_tool_keyword","Proxifier","allows to proxy connections for programs","T1090 - T1071 - T1078.003","TA0005","N/A","Scattered Spider* - Proxifier","Defense Evasion","https://www.proxifier.com/download/","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*http://www.proxifier.com/distr/last_versions/ProxifierPortable*",".{0,1000}http\:\/\/www\.proxifier\.com\/distr\/last_versions\/ProxifierPortable.{0,1000}","greyware_tool_keyword","Proxifier","allows to proxy connections for programs","T1090 - T1071 - T1078.003","TA0005","N/A","Scattered Spider* - Proxifier","Defense Evasion","https://www.proxifier.com/download/","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*http://zerobinftagjpeeebbvyzjcqyjpmjvynj5qlexwyxe7l3vqejxnqv5qd.onion*",".{0,1000}http\:\/\/zerobinftagjpeeebbvyzjcqyjpmjvynj5qlexwyxe7l3vqejxnqv5qd\.onion.{0,1000}","greyware_tool_keyword","zerobin.net","accessing paste raw content","T1119","TA0009","N/A","N/A","Collection","https://zerobin.net/","1","1","#PastebinLike","N/A","8","8","N/A","N/A","N/A","N/A"
"*https://*.*.devtunnels.ms*",".{0,1000}https\:\/\/.{0,1000}\..{0,1000}\.devtunnels\.ms.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://*.*.devtunnels.ms*",".{0,1000}https\:\/\/.{0,1000}\..{0,1000}\.devtunnels\.ms.{0,1000}","greyware_tool_keyword","vscode","built-in port forwarding. This feature allows you to share locally running services over the internet to other people and devices.","T1090 - T1003 - T1571","TA0010 - TA0002 - TA0009","N/A","N/A","C2","https://twitter.com/code/status/1699869087071899669","0","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.app.github.dev/*",".{0,1000}https\:\/\/.{0,1000}\.app\.github\.dev\/.{0,1000}","greyware_tool_keyword","github","access to a GitHub Codespace environment - Github Codespaces have a public port forwarding option allowing you to make your server available for the public.","T1071 - T1572","TA0001 - TA0005","N/A","N/A","Collection","https://detect.fyi/how-threat-actors-use-github-bd991c11ed37","0","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*https://*.brs.devtunnels.ms/*",".{0,1000}https\:\/\/.{0,1000}\.brs\.devtunnels\.ms\/.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","0","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://*.btunnel.co.in*",".{0,1000}https\:\/\/.{0,1000}\.btunnel\.co\.in.{0,1000}","greyware_tool_keyword","btunnel","Btunnel is a publicly accessible reverse proxy","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://www.btunnel.in","1","1","N/A","N/A","9","8","N/A","N/A","N/A","N/A"
"*https://*.btunnel.co.in*",".{0,1000}https\:\/\/.{0,1000}\.btunnel\.co\.in.{0,1000}","greyware_tool_keyword","btunnel","Btunnel is a publicly accessible reverse proxy","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://www.btunnel.in","1","1","N/A","N/A","9","8","N/A","N/A","N/A","N/A"
"*https://*.btunnel.co.in*",".{0,1000}https\:\/\/.{0,1000}\.btunnel\.co\.in.{0,1000}","greyware_tool_keyword","btunnel.in","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://www.btunnel.in/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.dev.servers.ddns.softether-network.net/ddns/ddns.aspx*",".{0,1000}https\:\/\/.{0,1000}\.dev\.servers\.ddns\.softether\-network\.net\/ddns\/ddns\.aspx.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*https://*.dev.servers-v6.ddns.softether-network.net/ddns/ddns.aspx*",".{0,1000}https\:\/\/.{0,1000}\.dev\.servers\-v6\.ddns\.softether\-network\.net\/ddns\/ddns\.aspx.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*https://*.euw.devtunnels.ms*",".{0,1000}https\:\/\/.{0,1000}\.euw\.devtunnels\.ms.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","0","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://*.fex.net/download/*",".{0,1000}https\:\/\/.{0,1000}\.fex\.net\/download\/.{0,1000}","greyware_tool_keyword","fex.net","hosting service abused by attackers","T1583.003 - T1071 - T1102","TA0010 - TA0005 - TA0009","N/A","N/A","Collection","https://fex.net","1","1","#filehostingservice","downloading a file","10","10","N/A","N/A","N/A","N/A"
"*https://*.fex.net/upload/*",".{0,1000}https\:\/\/.{0,1000}\.fex\.net\/upload\/.{0,1000}","greyware_tool_keyword","fex.net","hosting service abused by attackers","T1583.003 - T1071 - T1102","TA0010 - TA0005 - TA0009","N/A","N/A","Data Exfiltration","https://fex.net","1","1","#filehostingservice","uploading a file","10","10","N/A","N/A","N/A","N/A"
"*https://*.free.beeceptor.com*",".{0,1000}https\:\/\/.{0,1000}\.free\.beeceptor\.com.{0,1000}","greyware_tool_keyword","beeceptor.com","temporary public URL for your localhost + port combination - ideal for real-time testing - can be abused for payload callback confirmation","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://beeceptor.com/local-tunnel","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.localhost.run*",".{0,1000}https\:\/\/.{0,1000}\.localhost\.run.{0,1000}","greyware_tool_keyword","localhost.run","Put a locally running HTTP HTTPS or TLS app on the internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://localhost.run/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.localtunnel.me*",".{0,1000}https\:\/\/.{0,1000}\.localtunnel\.me.{0,1000}","greyware_tool_keyword","localtunnels","client for localtunnel.me - localtunnel exposes your localhost to the world for easy testing and sharing","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/localtunnel/localtunnel","1","1","N/A","N/A","8","10","20234","1399","2024-03-20T17:04:54Z","2012-06-18T02:33:30Z"
"*https://*.my.auvik.com/*",".{0,1000}https\:\/\/.{0,1000}\.my\.auvik\.com\/.{0,1000}","greyware_tool_keyword","auvik","cloud-based network management software","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.auvik.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.pagekite.me*",".{0,1000}https\:\/\/.{0,1000}\.pagekite\.me.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*https://*.pulseway.com/app/main/*",".{0,1000}https\:\/\/.{0,1000}\.pulseway\.com\/app\/main\/.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.remote.moe/*",".{0,1000}https\:\/\/.{0,1000}\.remote\.moe\/.{0,1000}","greyware_tool_keyword","remotemoe","remotemoe is a software daemon for exposing ad-hoc services to the internet without having to deal with the regular network stuff such as configuring VPNs - changing firewalls - or adding port forwards","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/fasmide/remotemoe","1","1","N/A","N/A","10","10","284","32","2024-06-03T14:00:47Z","2020-06-11T07:41:03Z"
"*https://*.screenconnect.com/Bin/*.exe*",".{0,1000}https\:\/\/.{0,1000}\.screenconnect\.com\/Bin\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","screenconnect.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.screenconnect.com/Host*",".{0,1000}https\:\/\/.{0,1000}\.screenconnect\.com\/Host.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.sendspace.com/upload*",".{0,1000}https\:\/\/.{0,1000}\.sendspace\.com\/upload.{0,1000}","greyware_tool_keyword","sendspace.com","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","Dispossessor - Black Basta - Hive - Ragnar Locker - Royal - LockBit - Vice Society","Data Exfiltration","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://*.serveo.net*",".{0,1000}https\:\/\/.{0,1000}\.serveo\.net.{0,1000}","greyware_tool_keyword","serveo.net","Expose local servers to the internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://serveo.net","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.ssi.sh*",".{0,1000}https\:\/\/.{0,1000}\.ssi\.sh.{0,1000}","greyware_tool_keyword","sish","HTTP(S)/WS(S)/TCP Tunnels to localhost using only SSH.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/antoniomika/sish","1","1","N/A","N/A","10","10","4134","317","2025-02-23T16:05:12Z","2019-02-15T15:36:23Z"
"*https://*.tacticalrmm.com/*",".{0,1000}https\:\/\/.{0,1000}\.tacticalrmm\.com\/.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*https://*.telebit.io*",".{0,1000}https\:\/\/.{0,1000}\.telebit\.io.{0,1000}","greyware_tool_keyword","telebit.cloud","Access your devices - Share your stuff (shell from telebit.cloud)","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://telebit.cloud/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.trycloudfare.com*",".{0,1000}https\:\/\/.{0,1000}\.trycloudfare\.com.{0,1000}","greyware_tool_keyword","trycloudflare.com","The subdomain .trycloudflare.com is a temporary hostname provided by Cloudflare Tunnel - It allows users to expose local services to the internet without needing to configure port forwarding or a public IP - attackers frequently abuse it for malicious activities","T1071.001 - T1090 - T1583.003 - T1102","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","Phishing","https://www.forcepoint.com/blog/x-labs/asyncrat-python-trycloudflare-malware","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.trycloudflare.com*",".{0,1000}https\:\/\/.{0,1000}\.trycloudflare\.com.{0,1000}","greyware_tool_keyword","trycloudflare.com","Attackers abuse this service to expose malicious servers on a *.trycloudflare.com subdomain","T1567.002 - T1102 - T1071.001 - T1036","TA0001 - TA0005 - TA0009","N/A","N/A","Collection","https://lots-project.com/site/2a2e747279636c6f7564666c6172652e636f6d","0","1","N/A","N/A","8","8","N/A","N/A","N/A","N/A"
"*https://*.tunnelmole.net*",".{0,1000}https\:\/\/.{0,1000}\.tunnelmole\.net.{0,1000}","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*https://*.use.devtunnels.ms*",".{0,1000}https\:\/\/.{0,1000}\.use\.devtunnels\.ms.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","0","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://*.zoho.com/pconnect*",".{0,1000}https\:\/\/.{0,1000}\.zoho\.com\/pconnect.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.zohoassist.com/w_socket*",".{0,1000}https\:\/\/.{0,1000}\.zohoassist\.com\/w_socket.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.zrok.io*",".{0,1000}https\:\/\/.{0,1000}\.zrok\.io.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*https://*:9000/restic*",".{0,1000}https\:\/\/.{0,1000}\:9000\/restic.{0,1000}","greyware_tool_keyword","restic","backup program used by threat actors for data exfiltration","T1567","TA0009 - TA0010","N/A","INC Ransom - Lynx","Data Exfiltration","https://github.com/restic/restic","1","1","N/A","N/A","8","10","27784","1585","2025-03-01T01:53:27Z","2014-04-27T14:07:58Z"
"*https://0bin.net/paste/*+*",".{0,1000}https\:\/\/0bin\.net\/paste\/.{0,1000}\+.{0,1000}","greyware_tool_keyword","0bin.net","Accessing a paste on 0bin.net","T1213 - T1190","TA0001 - TA0009 - TA0010","N/A","N/A","Collection","https://0bin.net","1","1","#PastebinLike","N/A","5","10","N/A","N/A","N/A","N/A"
"*https://0bin.net/paste/create*",".{0,1000}https\:\/\/0bin\.net\/paste\/create.{0,1000}","greyware_tool_keyword","0bin.net","Creating a paste on 0bin.net","T1213 - T1190","TA0001 - TA0009 - TA0010","N/A","N/A","Data Exfiltration","https://0bin.net","1","1","#PastebinLike","N/A","9","10","N/A","N/A","N/A","N/A"
"*https://12ft.io/api/proxy?q=http*",".{0,1000}https\:\/\/12ft\.io\/api\/proxy\?q\=http.{0,1000}","greyware_tool_keyword","12ft.io","Attackers can use 12ft.io to masquerade their domain for phishing purposes.","T1204.002 - T1036 - T1566.002","TA0001 - TA0005","N/A","N/A","Defense Evasion","https://12ft.io/","0","1","N/A","N/A","5","5","N/A","N/A","N/A","N/A"
"*https://12ft.io/proxy?q=*",".{0,1000}https\:\/\/12ft\.io\/proxy\?q\=.{0,1000}","greyware_tool_keyword","12ft.io","Attackers can use 12ft.io to masquerade their domain for phishing purposes.","T1204.002 - T1036 - T1566.002","TA0001 - TA0005","N/A","N/A","Defense Evasion","https://12ft.io/","0","1","N/A","N/A","5","5","N/A","N/A","N/A","N/A"
"*https://1ty.me/*",".{0,1000}https\:\/\/1ty\.me\/.{0,1000}","greyware_tool_keyword","1ty.me","temporary notes service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","N/A","Collection","https://1ty.me","1","1","#PastebinLike","downloading or uploading data","10","10","N/A","N/A","N/A","N/A"
"*https://1ty.me/?mode=ajax&cmd=create_note*",".{0,1000}https\:\/\/1ty\.me\/\?mode\=ajax\&cmd\=create_note.{0,1000}","greyware_tool_keyword","1ty.me","temporary notes service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://1ty.me","1","1","#PastebinLike","creating note","10","10","N/A","N/A","N/A","N/A"
"*https://aadinternals.com/aadinternals/*",".{0,1000}https\:\/\/aadinternals\.com\/aadinternals\/.{0,1000}","greyware_tool_keyword","AADInternals","AADInternals PowerShell module for administering Azure AD and Office 365","T1583 - T1558 - T1078 - T1136 - T1087 - T1114 - T1566 - T1056 - T1199 - T1098 - T1649 - T1621 - T1649","TA0006 - TA0003 - TA0004 - TA0005 - TA0007 - TA0009 - TA0011","N/A","APT29 - COZY BEAR","Exploitation tool","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","9","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*https://aka.ms/DevTunnelCliInstall*",".{0,1000}https\:\/\/aka\.ms\/DevTunnelCliInstall.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","0","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://aka.ms/TunnelsCliDownload/*",".{0,1000}https\:\/\/aka\.ms\/TunnelsCliDownload\/.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://anonfiles.com/*/*",".{0,1000}https\:\/\/anonfiles\.com\/.{0,1000}\/.{0,1000}","greyware_tool_keyword","anonfiles.com","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","BlackCat - BitLocker - AvosLocker - Hive - Royal - LockBit - Vice Society - Conti - RansomHub","Collection","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://anymailfinder.com/search/*",".{0,1000}https\:\/\/anymailfinder\.com\/search\/.{0,1000}","greyware_tool_keyword","anymailfinder","used by attackers to find informations about a company users","T1593 - T1596 - T1213","TA0009","N/A","N/A","Reconnaissance","https://anymailfinder.com","1","1","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://apaste.info/p/new*",".{0,1000}https\:\/\/apaste\.info\/p\/new.{0,1000}","greyware_tool_keyword","apaste.info","Creating a paste on apaste.info/","T1213 - T1190","TA0001 - TA0009 - TA0010","N/A","N/A","Data Exfiltration","https://apaste.info/","1","1","#PastebinLike","N/A","9","10","N/A","N/A","N/A","N/A"
"*https://api.anonfiles.com/upload*",".{0,1000}https\:\/\/api\.anonfiles\.com\/upload.{0,1000}","greyware_tool_keyword","anonfiles.com","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","BlackCat - BitLocker - AvosLocker - Hive - Royal - LockBit - Vice Society - Conti - RansomHub","Data Exfiltration","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://api.dropboxapi.com/*",".{0,1000}https\:\/\/api\.dropboxapi\.com\/.{0,1000}","greyware_tool_keyword","DBC2","DBC2 (DropboxC2) is a modular post-exploitation tool composed of an agent running on the victim's machine - a controler running on any machine - powershell modules and Dropbox servers as a means of communication.","T1105 - T1071.004 - T1102","TA0003 - TA0002 - TA0008","N/A","BlackCat - Scattered Spider*","C2","https://github.com/Arno0x/DBC2","1","1","N/A","Dropbox API calls - Understanding your environment with the applications used and allowed will enhances the effectiveness of your hunt here","10","10","294","84","2017-10-27T07:39:02Z","2016-12-14T10:35:56Z"
"*https://api.fex.net/api/v1/anonymous/file*",".{0,1000}https\:\/\/api\.fex\.net\/api\/v1\/anonymous\/file.{0,1000}","greyware_tool_keyword","fex.net","hosting service abused by attackers","T1583.003 - T1071 - T1102","TA0010 - TA0005 - TA0009","N/A","N/A","Data Exfiltration","https://fex.net","1","1","#filehostingservice","uploading a file","10","10","N/A","N/A","N/A","N/A"
"*https://api.freefilesync.org/new_installation*",".{0,1000}https\:\/\/api\.freefilesync\.org\/new_installation.{0,1000}","greyware_tool_keyword","freefilesync","freefilesync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","LockBit","Data Exfiltration","https://freefilesync.org/download.php","1","1","#filehostingservice","N/A","9","10","N/A","N/A","N/A","N/A"
"*https://api.hunter.io/*",".{0,1000}https\:\/\/api\.hunter\.io\/.{0,1000}","greyware_tool_keyword","Hunter.io","used by attacker and pentester while gathering information. Hunter lets you find email addresses in seconds and connect with the people that matter for your business","T1597 - T1526 - T1087 - T1078 - T1056 - T1018 - T1016 - T1583 - T1589","TA0001 - TA0002 - TA0003 - TA0005 - TA0007 - TA0011","N/A","N/A","Reconnaissance","https://hunter.io/","1","1","N/A","N/A","N/A","10","N/A","N/A","N/A","N/A"
"*https://api.openai.com/v1/files*",".{0,1000}https\:\/\/api\.openai\.com\/v1\/files.{0,1000}","greyware_tool_keyword","ratchatpt","C2 using openAI API","T1094 - T1071.001","TA0011 - TA0002","N/A","N/A","C2","https://github.com/spartan-conseil/ratchatpt","0","1","N/A","risk of False positive","10","10","13","5","2023-06-09T12:39:00Z","2023-06-09T09:19:10Z"
"*https://api.tailscale.com/api/v2/*",".{0,1000}https\:\/\/api\.tailscale\.com\/api\/v2\/.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*https://api.telegram.org/bot*/sendMessage*",".{0,1000}https\:\/\/api\.telegram\.org\/bot.{0,1000}\/sendMessage.{0,1000}","greyware_tool_keyword","TelegramRAT","Cross Platform Telegram based RAT that communicates via telegram to evade network restrictions","T1071.001 - T1105 - T1027","TA0011 - TA0005 - TA0002","N/A","N/A","C2","https://github.com/machine1337/TelegramRAT","1","1","N/A","N/A","10","10","358","58","2024-01-23T12:05:59Z","2023-06-30T10:59:55Z"
"*https://app.action1.com/agent/*/Windows/*.msi*",".{0,1000}https\:\/\/app\.action1\.com\/agent\/.{0,1000}\/Windows\/.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","https://app.action1.com/agent/{ID}/Windows/agent(My_Organization).msi","10","10","N/A","N/A","N/A","N/A"
"*https://app.level.io/devices*",".{0,1000}https\:\/\/app\.level\.io\/devices.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://apps.apple.com/us/app/tailscale/id*",".{0,1000}https\:\/\/apps\.apple\.com\/us\/app\/tailscale\/id.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","#macos","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*https://assist.zoho.com/assist-join?key=*",".{0,1000}https\:\/\/assist\.zoho\.com\/assist\-join\?key\=.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/customer-session-details?client_token=*",".{0,1000}https\:\/\/assist\.zoho\.com\/customer\-session\-details\?client_token\=.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/join?join_source=EMAIL_INVITE*",".{0,1000}https\:\/\/assist\.zoho\.com\/join\?join_source\=EMAIL_INVITE.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/join-session?key=*",".{0,1000}https\:\/\/assist\.zoho\.com\/join\-session\?key\=.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/org/*",".{0,1000}https\:\/\/assist\.zoho\.com\/org\/.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/viewer-assist*",".{0,1000}https\:\/\/assist\.zoho\.com\/viewer\-assist.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://aur.archlinux.org/jprq.git*",".{0,1000}https\:\/\/aur\.archlinux\.org\/jprq\.git.{0,1000}","greyware_tool_keyword","jprq","expose TCP protocols such as HTTP - SSH etc. Any server!","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/azimjohn/jprq","1","1","#linux","N/A","10","10","1260","175","2025-01-25T10:39:59Z","2020-04-18T10:12:42Z"
"*https://bashupload.com*",".{0,1000}https\:\/\/bashupload\.com.{0,1000}","greyware_tool_keyword","bashupload.com","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","N/A","Data Exfiltration","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://bayfiles.com/*",".{0,1000}https\:\/\/bayfiles\.com\/.{0,1000}","greyware_tool_keyword","bayfiles","hosting site abused by attackers - blocked site in a lot of countries","T1567 - T1071 - T1020 - T1005","TA0010 - TA0009","N/A","CyClops","Collection","N/A","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://bitbucket.org/*/downloads/*.bat*",".{0,1000}https\:\/\/bitbucket\.org\/.{0,1000}\/downloads\/.{0,1000}\.bat.{0,1000}","greyware_tool_keyword","bitbucket.org","legitimate hosting platform abused by malwares like lummastealer","T1213 - T1102","TA0009","Lumma Stealer","N/A","Collection","N/A","0","1","#filehostingservice","N/A","5","7","N/A","N/A","N/A","N/A"
"*https://bitbucket.org/*/downloads/*.dll*",".{0,1000}https\:\/\/bitbucket\.org\/.{0,1000}\/downloads\/.{0,1000}\.dll.{0,1000}","greyware_tool_keyword","bitbucket.org","legitimate hosting platform abused by malwares like lummastealer","T1213 - T1102","TA0009","Lumma Stealer","N/A","Collection","N/A","0","1","#filehostingservice","N/A","5","7","N/A","N/A","N/A","N/A"
"*https://bitbucket.org/*/downloads/*.dll*",".{0,1000}https\:\/\/bitbucket\.org\/.{0,1000}\/downloads\/.{0,1000}\.dll.{0,1000}","greyware_tool_keyword","bitbucket.org","legitimate hosting platform abused by malwares like lummastealer","T1213 - T1102","TA0009","Lumma Stealer","N/A","Collection","N/A","0","1","#filehostingservice","N/A","5","7","N/A","N/A","N/A","N/A"
"*https://bitbucket.org/*/downloads/*.exe*",".{0,1000}https\:\/\/bitbucket\.org\/.{0,1000}\/downloads\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","bitbucket.org","legitimate hosting platform abused by malwares like lummastealer","T1213 - T1102","TA0009","Lumma Stealer","N/A","Collection","N/A","0","1","#filehostingservice","N/A","5","7","N/A","N/A","N/A","N/A"
"*https://bitbucket.org/*/downloads/*.ps1*",".{0,1000}https\:\/\/bitbucket\.org\/.{0,1000}\/downloads\/.{0,1000}\.ps1.{0,1000}","greyware_tool_keyword","bitbucket.org","legitimate hosting platform abused by malwares like lummastealer","T1213 - T1102","TA0009","Lumma Stealer","N/A","Collection","N/A","0","1","#filehostingservice","N/A","5","7","N/A","N/A","N/A","N/A"
"*https://bitbucket.org/*/downloads/*.rar*",".{0,1000}https\:\/\/bitbucket\.org\/.{0,1000}\/downloads\/.{0,1000}\.rar.{0,1000}","greyware_tool_keyword","bitbucket.org","legitimate hosting platform abused by malwares like lummastealer","T1213 - T1102","TA0009","Lumma Stealer","N/A","Collection","N/A","0","1","#filehostingservice","N/A","5","7","N/A","N/A","N/A","N/A"
"*https://bitbucket.org/*/downloads/*.zip*",".{0,1000}https\:\/\/bitbucket\.org\/.{0,1000}\/downloads\/.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","bitbucket.org","legitimate hosting platform abused by malwares like lummastealer","T1213 - T1102","TA0009","Lumma Stealer","N/A","Collection","N/A","0","1","#filehostingservice","N/A","5","7","N/A","N/A","N/A","N/A"
"*https://boringproxy.io/installation*",".{0,1000}https\:\/\/boringproxy\.io\/installation.{0,1000}","greyware_tool_keyword","boringproxy","Simple tunneling reverse proxy with a fast web UI and auto HTTPS. Designed for self-hosters.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/boringproxy/boringproxy","1","1","N/A","N/A","10","10","1258","119","2024-07-06T10:13:37Z","2020-09-26T21:58:07Z"
"*https://browser.lol/vnc?server=*",".{0,1000}https\:\/\/browser\.lol\/vnc\?server\=.{0,1000}","greyware_tool_keyword","browser.lol","Virtual Browser - Safely visit blocked or risky websites - can be used to bypass network restrictions within a corporate environment","T1071 - T1090 - T1562","TA0005","N/A","N/A","Defense Evasion","https://browser.lol","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*https://burrow.io/tunnels*",".{0,1000}https\:\/\/burrow\.io\/tunnels.{0,1000}","greyware_tool_keyword","burrow","Expose localhost to the internet using a public URL","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://burrow.io","1","1","N/A","N/A","9","8","N/A","N/A","N/A","N/A"
"*https://c3pool.com/#/*",".{0,1000}https\:\/\/c3pool\.com\/\#\/.{0,1000}","greyware_tool_keyword","xmrig","Auto setup scripts and pre-compiled xmr miner for c3pool.com pool","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*https://clbin.com/*",".{0,1000}https\:\/\/clbin\.com\/.{0,1000}","greyware_tool_keyword","clbin.com","clbin.com be used for C&C purposes. The attacker will place commands on a textbin paste and have the malware fetch the commands.","T1567.002","TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://clbin.com/","1","1","#PastebinLike","N/A","8","8","N/A","N/A","N/A","N/A"
"*https://cloud.screenconnect.com/#/trialtoinstance?cookieValue=*",".{0,1000}https\:\/\/cloud\.screenconnect\.com\/\#\/trialtoinstance\?cookieValue\=.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://content.dropboxapi.com/2/files/upload*",".{0,1000}https\:\/\/content\.dropboxapi\.com\/2\/files\/upload.{0,1000}","greyware_tool_keyword","dropbox","uploading file to dropbox with the API","T1105 - T1071.001 - T1567.002","TA0011 - TA0009 - TA0010","N/A","BlackCat - Scattered Spider* - Operation BugDrop - COZY BEAR - Turla - LockBit - Pandora","Data Exfiltration","https://github.com/I-Am-Jakoby/PowerShell-for-Hackers/blob/main/Functions/DropBox-Upload.md","1","1","#filehostingservice","N/A","7","10","1184","141","2024-06-16T04:10:39Z","2022-05-10T04:12:53Z"
"*https://crates.io/crates/localtunnel-client*",".{0,1000}https\:\/\/crates\.io\/crates\/localtunnel\-client.{0,1000}","greyware_tool_keyword","Rust Localtunnels","Localtunnel implementation in Rust - exposes your localhost endpoint to the world","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/kaichaosun/rlt","1","1","N/A","N/A","7","2","113","13","2024-12-16T09:09:34Z","2022-06-27T05:57:34Z"
"*https://crates.io/crates/localtunnel-server*",".{0,1000}https\:\/\/crates\.io\/crates\/localtunnel\-server.{0,1000}","greyware_tool_keyword","Rust Localtunnels","Localtunnel implementation in Rust - exposes your localhost endpoint to the world","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/kaichaosun/rlt","1","1","N/A","N/A","7","2","113","13","2024-12-16T09:09:34Z","2022-06-27T05:57:34Z"
"*https://docs.level.io/1.0/admin-guides/level-watchdog-task*",".{0,1000}https\:\/\/docs\.level\.io\/1\.0\/admin\-guides\/level\-watchdog\-task.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://download.advanced-ip-scanner.com/download/files/*.exe*",".{0,1000}https\:\/\/download\.advanced\-ip\-scanner\.com\/download\/files\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","advanced-ip-scanner","The program shows all network devices. gives you access to shared folders. provides remote control of computers (via RDP and Radmin) and can even remotely switch computers off. It is easy to use and runs as a portable edition (abused by TA)","T1135 - T1021 - T1016 - T1046","TA0007 - TA0043","N/A","MAZE - BlackSuit - Royal - Akira - LockBit - Diavol - GoGoogle - INC Ransom - Hive - ZolaConti2 - Darkside - UNC24653 - Egregor4 - Hades - Evilcorp5 - REvil6 - Ryuk - UNC18787 - UNC24477 - Vice Society - FiveHands - Sarcoma - DragonForce - MedusaLocker - Mimic - Loki","Discovery","https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*https://downloads.level.io/install_linux.sh*",".{0,1000}https\:\/\/downloads\.level\.io\/install_linux\.sh.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://downloads.level.io/install_mac_os.sh*",".{0,1000}https\:\/\/downloads\.level\.io\/install_mac_os\.sh.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://downloads.level.io/install_windows.exe*",".{0,1000}https\:\/\/downloads\.level\.io\/install_windows\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://downloads.level.io/stable/level-linux-amd64*",".{0,1000}https\:\/\/downloads\.level\.io\/stable\/level\-linux\-amd64.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://downloads.solarwinds.com/solarwinds/Release/DameWare/*",".{0,1000}https\:\/\/downloads\.solarwinds\.com\/solarwinds\/Release\/DameWare\/.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*https://dropmefiles.com/*",".{0,1000}https\:\/\/dropmefiles\.com\/.{0,1000}","greyware_tool_keyword","dropmefiles.com","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","Mallox - Dispossessor - BitLocker - Black Basta - Hive - Royal - LockBit - Vice Society","Collection","https://github.com/Casualtek/Ransomchats/blob/4a25ac6ad165a4e600aeb72718c3ad41e8f6ce3a/Mallox/20230427.json#L286C25-L286C48","1","1","#filehostingservice","downloading files url","8","5","482","50","2025-01-24T16:38:39Z","2023-05-02T16:17:48Z"
"*https://dropmefiles.com/s3/upload/*",".{0,1000}https\:\/\/dropmefiles\.com\/s3\/upload\/.{0,1000}","greyware_tool_keyword","dropmefiles.com","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","Mallox - Dispossessor - BitLocker - Black Basta - Hive - Royal - LockBit - Vice Society","Data Exfiltration","https://github.com/Casualtek/Ransomchats/blob/4a25ac6ad165a4e600aeb72718c3ad41e8f6ce3a/Mallox/20230427.json#L286C25-L286C48","1","1","#filehostingservice","uploading files url","10","5","482","50","2025-01-24T16:38:39Z","2023-05-02T16:17:48Z"
"*https://easyupload.io/*",".{0,1000}https\:\/\/easyupload\.io\/.{0,1000}","greyware_tool_keyword","easyupload.io","file hosting platform abused by attackers to host malicious - url used when downloading a file on the site","T1567.002 - T1071.001 - T1041 - T1036.002","TA0009","N/A","Black Basta","Collection","N/A","1","1","#filehostingservice","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://easyupload.io/action.php*",".{0,1000}https\:\/\/easyupload\.io\/action\.php.{0,1000}","greyware_tool_keyword","easyupload.io","hosting platform abused by attackers","T1105 - T1071.001 - T1567.002 - T1041","TA0010 - TA0005","N/A","Akira","Data Exfiltration","N/A","1","1","#filehostingservice","uploading url","8","6","N/A","N/A","N/A","N/A"
"*https://easyupload.io/cdn-cgi/rum*",".{0,1000}https\:\/\/easyupload\.io\/cdn\-cgi\/rum.{0,1000}","greyware_tool_keyword","easyupload.io","hosting platform abused by attackers","T1105 - T1071.001 - T1567.002 - T1041","TA0010 - TA0005","N/A","Akira","Data Exfiltration","N/A","1","1","#filehostingservice","uploading url","8","6","N/A","N/A","N/A","N/A"
"*https://expose.dev/api/servers*",".{0,1000}https\:\/\/expose\.dev\/api\/servers.{0,1000}","greyware_tool_keyword","expose","tunneling service - written in pure PHP","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/beyondcode/expose","1","1","N/A","N/A","10","10","4344","271","2025-02-28T13:35:11Z","2020-04-14T19:18:38Z"
"*https://expose.dev/register*",".{0,1000}https\:\/\/expose\.dev\/register.{0,1000}","greyware_tool_keyword","expose","tunneling service - written in pure PHP","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/beyondcode/expose","1","1","N/A","N/A","10","10","4344","271","2025-02-28T13:35:11Z","2020-04-14T19:18:38Z"
"*https://file.io/*",".{0,1000}https\:\/\/file\.io\/.{0,1000}","greyware_tool_keyword","file.io","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","BlackCat - Black Basta - Akira - AvosLocker - Hive - Ragnar Locker - Royal - LockBit - Vice Society - Conti","Collection","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://file.io/?title=*",".{0,1000}https\:\/\/file\.io\/\?title\=.{0,1000}","greyware_tool_keyword","file.io","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","BlackCat - Black Basta - Akira - AvosLocker - Hive - Ragnar Locker - Royal - LockBit - Vice Society - Conti","Data Exfiltration","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://filebin.net/*",".{0,1000}https\:\/\/filebin\.net\/.{0,1000}","greyware_tool_keyword","filebin.net","file hosting platform abused by attackers to host malicious file - raw access and api available","T1119","TA0009 - TA0010","N/A","N/A","Collection","https://filebin.net","1","1","#filehostingservice","N/A","8","8","N/A","N/A","N/A","N/A"
"*https://files.catbox.moe/*","https:\/\/files\.catbox\.moe\/[^\s\n]+","greyware_tool_keyword","catbox.moe","The cutest free file host you've ever seen - abused by threat actors","T1560.001 - T1190 - T1102 - T1027.002","TA0001 - TA0005 - TA0042","N/A","N/A","Collection","https://files[.]catbox.moe","1","1","#filehostingservice","N/A","9","10","N/A","N/A","N/A","N/A"
"*https://fleetdm.com/resources/install-fleetctl.sh*",".{0,1000}https\:\/\/fleetdm\.com\/resources\/install\-fleetctl\.sh.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3595","488","2025-03-02T13:50:14Z","2020-11-03T22:17:18Z"
"*https://freefilesync.org/donate*",".{0,1000}https\:\/\/freefilesync\.org\/donate.{0,1000}","greyware_tool_keyword","freefilesync","freefilesync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","LockBit","Data Exfiltration","https://freefilesync.org/download.php","1","1","#filehostingservice","N/A","9","10","N/A","N/A","N/A","N/A"
"*https://get.telebit.io*",".{0,1000}https\:\/\/get\.telebit\.io.{0,1000}","greyware_tool_keyword","telebit.cloud","Access your devices - Share your stuff (shell from telebit.cloud)","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://telebit.cloud/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://github.com/mandiant/SilkETW/releases/download/v0.8/SilkETW_SilkService_v8.zip*",".{0,1000}https\:\/\/github\.com\/mandiant\/SilkETW\/releases\/download\/v0\.8\/SilkETW_SilkService_v8\.zip.{0,1000}","greyware_tool_keyword","Invoke-Maldaptive","MaLDAPtive is a framework for LDAP SearchFilter parsing - obfuscation - deobfuscation and detection.","T1027","TA0005 - TA0007","N/A","N/A","Discovery","https://github.com/MaLDAPtive/Invoke-Maldaptive","1","1","N/A","N/A","7","3","261","24","2024-08-07T21:12:45Z","2024-08-07T20:43:52Z"
"*https://github-com.translate.goog/*",".{0,1000}https\:\/\/github\-com\.translate\.goog\/.{0,1000}","greyware_tool_keyword","translate.goog","accessing github through google translate (evasion) false positive risk","T1090.003","TA0005","N/A","N/A","Defense Evasion","https://*-com.translate.goog/*","0","1","N/A","N/A","1","3","N/A","N/A","N/A","N/A"
"*https://gofile.io/d/*",".{0,1000}https\:\/\/gofile\.io\/d\/.{0,1000}","greyware_tool_keyword","ransomware_notes","detection patterns retrieved in ransomware notes archives","T1486","TA0040","N/A","N/A","Ransomware","https://github.com/threatlabz/ransomware_notes","1","1","N/A","downloading files from gofile.io","10","4","342","52","2025-02-18T18:47:47Z","2022-08-01T15:14:59Z"
"*https://googleweblight.com/i?u=*ipfs.*.html*",".{0,1000}https\:\/\/googleweblight\.com\/i\?u\=.{0,1000}ipfs\..{0,1000}\.html.{0,1000}","greyware_tool_keyword","googleweblight.com","Open Redirect vulnerability being exploited by threat actors in Google Web Light","T1584.001 - T1534","TA0008","N/A","N/A","Phishing","https://x.com/1ZRR4H/status/1723062039680000255","1","1","N/A","N/A","9","10","N/A","N/A","N/A","N/A"
"*https://gost.run/tutorials/*",".{0,1000}https\:\/\/gost\.run\/tutorials\/.{0,1000}","greyware_tool_keyword","gost","GO Simple Tunnel - a simple tunnel written in golang","T1572","TA0011 - TA0003","N/A","Dispossessor - EMBER BEAR","C2","https://github.com/go-gost/gost","1","1","N/A","N/A","10","10","4729","550","2025-02-18T15:35:15Z","2020-02-12T14:58:08Z"
"*https://gost.run/tutorials/api/config*",".{0,1000}https\:\/\/gost\.run\/tutorials\/api\/config.{0,1000}","greyware_tool_keyword","gost","GO Simple Tunnel - a simple tunnel written in golang","T1572","TA0011 - TA0003","N/A","Dispossessor - EMBER BEAR","C2","https://github.com/go-gost/gost","1","1","N/A","N/A","10","10","4729","550","2025-02-18T15:35:15Z","2020-02-12T14:58:08Z"
"*https://homeway.io/install.sh*",".{0,1000}https\:\/\/homeway\.io\/install\.sh.{0,1000}","greyware_tool_keyword","homeway.io","Expose local servers to the internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://homeway.io/","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://hunter.io/*",".{0,1000}https\:\/\/hunter\.io\/.{0,1000}","greyware_tool_keyword","Hunter.io","used by attacker and pentester while gathering information. Hunter lets you find email addresses in seconds and connect with the people that matter for your business","T1597 - T1526 - T1087 - T1078 - T1056 - T1018 - T1016 - T1583 - T1589","TA0001 - TA0002 - TA0003 - TA0005 - TA0007 - TA0011","N/A","N/A","Reconnaissance","https://hunter.io/","1","1","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://hypertunnel.ga*",".{0,1000}https\:\/\/hypertunnel\.ga.{0,1000}","greyware_tool_keyword","hypertunnel","Expose any local TCP/IP service on the internet","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/berstend/hypertunnel","1","1","N/A","N/A","10","10","246","47","2022-12-08T19:13:24Z","2018-06-11T05:29:58Z"
"*https://ip138.com/iplookup.asp?ip=*&action=2*",".{0,1000}https\:\/\/ip138\.com\/iplookup\.asp\?ip\=.{0,1000}\&action\=2.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://ipv4.myip.wtf/text*",".{0,1000}https\:\/\/ipv4\.myip\.wtf\/text.{0,1000}","greyware_tool_keyword","ipv4.myip.wtf","get public ip address. Used by disctopia-c2","T1016 - T1071.001","TA0005 - TA0002","N/A","N/A","Reconnaissance","https://github.com/3ct0s/disctopia-c2/blob/main/libraries/disctopia.py","1","1","N/A","greyware_tools high risks of false positives","N/A","10","590","132","2024-07-18T10:16:19Z","2022-01-02T22:03:10Z"
"*https://jprq.io/auth*",".{0,1000}https\:\/\/jprq\.io\/auth.{0,1000}","greyware_tool_keyword","jprq","expose TCP protocols such as HTTP - SSH etc. Any server!","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/azimjohn/jprq","1","1","N/A","N/A","10","10","1260","175","2025-01-25T10:39:59Z","2020-04-18T10:12:42Z"
"*https://jprq.io/install.sh*",".{0,1000}https\:\/\/jprq\.io\/install\.sh.{0,1000}","greyware_tool_keyword","jprq","expose TCP protocols such as HTTP - SSH etc. Any server!","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/azimjohn/jprq","1","1","N/A","N/A","10","10","1260","175","2025-01-25T10:39:59Z","2020-04-18T10:12:42Z"
"*https://link.remote.it/support/rpi-linux-quick-install*",".{0,1000}https\:\/\/link\.remote\.it\/support\/rpi\-linux\-quick\-install.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/installer","1","1","#linux","N/A","10","10","24","9","2024-04-17T00:45:45Z","2019-01-29T21:06:02Z"
"*https://localtunnel.me*",".{0,1000}https\:\/\/localtunnel\.me.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/localtunnel/localtunnel","1","1","N/A","N/A","10","10","20234","1399","2024-03-20T17:04:54Z","2012-06-18T02:33:30Z"
"*https://localtunnel.me*",".{0,1000}https\:\/\/localtunnel\.me.{0,1000}","greyware_tool_keyword","localtunnels","server for localtunnel.me - localtunnel exposes your localhost to the world for easy testing and sharing","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/localtunnel/server","1","1","N/A","N/A","8","10","3139","1022","2024-03-20T09:14:46Z","2013-06-16T22:30:48Z"
"*https://localxpose.io/download*",".{0,1000}https\:\/\/localxpose\.io\/download.{0,1000}","greyware_tool_keyword","localxpose","LocalXpose is a reverse proxy that enables you to expose your localhost to the internet","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://localxpose.io/","1","1","N/A","N/A","10","1","N/A","N/A","N/A","N/A"
"*https://login.remotepc.com/rpcnew*",".{0,1000}https\:\/\/login\.remotepc\.com\/rpcnew.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://login.tailscale.com/admin/settings/keys*",".{0,1000}https\:\/\/login\.tailscale\.com\/admin\/settings\/keys.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*https://maildrop.cc/inbox/?mailbox=*",".{0,1000}https\:\/\/maildrop\.cc\/inbox\/\?mailbox\=.{0,1000}","greyware_tool_keyword","maildrop","disposable email address to use anytime.","T1071.003","TA0005 - TA0001","N/A","N/A","Defense Evasion","https://maildrop.cc/","1","1","N/A","N/A","4","5","N/A","N/A","N/A","N/A"
"*https://media.discordapp.net/attachments/*.bat*",".{0,1000}https\:\/\/media\.discordapp\.net\/attachments\/.{0,1000}\.bat.{0,1000}","greyware_tool_keyword","discord","Downloading discord executables and archives attachments","T1189","TA0001 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","6","9","N/A","N/A","N/A","N/A"
"*https://media.discordapp.net/attachments/*.exe*",".{0,1000}https\:\/\/media\.discordapp\.net\/attachments\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","discord","Downloading discord executables and archives attachments","T1189","TA0001 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","6","9","N/A","N/A","N/A","N/A"
"*https://media.discordapp.net/attachments/*.hta*",".{0,1000}https\:\/\/media\.discordapp\.net\/attachments\/.{0,1000}\.hta.{0,1000}","greyware_tool_keyword","discord","Downloading discord executables and archives attachments","T1189","TA0001 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","6","9","N/A","N/A","N/A","N/A"
"*https://media.discordapp.net/attachments/*.iso*",".{0,1000}https\:\/\/media\.discordapp\.net\/attachments\/.{0,1000}\.iso.{0,1000}","greyware_tool_keyword","discord","Downloading discord executables and archives attachments","T1189","TA0001 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","6","9","N/A","N/A","N/A","N/A"
"*https://media.discordapp.net/attachments/*.jar*",".{0,1000}https\:\/\/media\.discordapp\.net\/attachments\/.{0,1000}\.jar.{0,1000}","greyware_tool_keyword","discord","Downloading discord executables and archives attachments","T1189","TA0001 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","6","9","N/A","N/A","N/A","N/A"
"*https://media.discordapp.net/attachments/*.msi*",".{0,1000}https\:\/\/media\.discordapp\.net\/attachments\/.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","discord","Downloading discord executables and archives attachments","T1189","TA0001 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","6","9","N/A","N/A","N/A","N/A"
"*https://media.discordapp.net/attachments/*.py*",".{0,1000}https\:\/\/media\.discordapp\.net\/attachments\/.{0,1000}\.py.{0,1000}","greyware_tool_keyword","discord","Downloading discord executables and archives attachments","T1189","TA0001 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","6","9","N/A","N/A","N/A","N/A"
"*https://media.discordapp.net/attachments/*.vbs*",".{0,1000}https\:\/\/media\.discordapp\.net\/attachments\/.{0,1000}\.vbs.{0,1000}","greyware_tool_keyword","discord","Downloading discord executables and archives attachments","T1189","TA0001 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","6","9","N/A","N/A","N/A","N/A"
"*https://media.discordapp.net/attachments/*.zip*",".{0,1000}https\:\/\/media\.discordapp\.net\/attachments\/.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","discord","Downloading discord executables and archives attachments","T1189","TA0001 - TA0009","N/A","N/A","Collection","N/A","1","1","N/A","N/A","6","9","N/A","N/A","N/A","N/A"
"*https://mega.io/cmd#download*",".{0,1000}https\:\/\/mega\.io\/cmd\#download.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*https://mega.nz/file/*",".{0,1000}https\:\/\/mega\.nz\/file\/.{0,1000}","greyware_tool_keyword","mega.nz","Direct file download links on Mega.nz - file sharing activity often abused by attackers for Collection","T1105 - T1114 - T1083","TA0009","N/A","Akira - Conti - mount-locker - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - MONTI - DarkSide - Black Basta","Collection","N/A","1","1","#filehostingservice #P2P","N/A","7","8","N/A","N/A","N/A","N/A"
"*https://mega.nz/folder/*",".{0,1000}https\:\/\/mega\.nz\/folder\/.{0,1000}","greyware_tool_keyword","mega.nz","Direct folder sharing links on Mega.nz for accessing multiple files - file sharing activity often abused by attackers for Collection","T1105 - T1114 - T1083","TA0009","N/A","Akira - Conti - mount-locker - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - MONTI - DarkSide - Black Basta","Collection","N/A","1","1","#filehostingservice #P2P","N/A","7","8","N/A","N/A","N/A","N/A"
"*https://mega.nz/folder/8L80QKyL#glRTp6Zc0gppwp03IG03tA*",".{0,1000}https\:\/\/mega\.nz\/folder\/8L80QKyL\#glRTp6Zc0gppwp03IG03tA.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*https://mega.nz/folder/bxomFKwL#3V1dUJFzL98t1GqXX29IXg*",".{0,1000}https\:\/\/mega\.nz\/folder\/bxomFKwL\#3V1dUJFzL98t1GqXX29IXg.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*https://mega.nz/folder/D0w0nYiY#egvjqP5R-anbBdsJg8QRVg*",".{0,1000}https\:\/\/mega\.nz\/folder\/D0w0nYiY\#egvjqP5R\-anbBdsJg8QRVg.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*https://mega.nz/folder/gflVFLhC#6neMkeJrt4dWboRTc1NLUg*",".{0,1000}https\:\/\/mega\.nz\/folder\/gflVFLhC\#6neMkeJrt4dWboRTc1NLUg.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","N/A","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*https://mega.nz/linux/repo/*",".{0,1000}https\:\/\/mega\.nz\/linux\/repo\/.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://mega.nz/linux/repo/*.deb*",".{0,1000}https\:\/\/mega\.nz\/linux\/repo\/.{0,1000}\.deb.{0,1000}","greyware_tool_keyword","MEGAcmd","Command Line Interactive and Scriptable Application to access MEGA (hosting service abused by attackers)","T1071 - T1041 - T1105","TA0010 - TA0009","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://github.com/meganz/MEGAcmd","1","1","#linux","N/A","10","10","2009","410","2025-02-05T09:57:14Z","2017-08-28T16:58:54Z"
"*https://meshcentral.com/login*",".{0,1000}https\:\/\/meshcentral\.com\/login.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","1","N/A","N/A","10","3","250","94","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*https://myexternalip.com/raw*",".{0,1000}https\:\/\/myexternalip\.com\/raw.{0,1000}","greyware_tool_keyword","myexternalip.com","return external ip address","T1046 - T1595 - T1595.001","TA0007 - TA0040","N/A","N/A","Reconnaissance","https://myexternalip.com/raw","1","1","N/A","False positives warning - used by some C2 projects but legitimate site","1","6","N/A","N/A","N/A","N/A"
"*https://new.express.adobe.com/publishedV2/urn:aaid:sc:*",".{0,1000}https\:\/\/new\.express\.adobe\.com\/publishedV2\/urn\:aaid\:sc\:.{0,1000}","greyware_tool_keyword","adobe.com","Attackers can use adobe.com to masquerade their domain for phishing purposes.","T1204.002 - T1036 - T1566.002","TA0001 - TA0005","N/A","N/A","Defense Evasion","N/A","0","1","N/A","N/A","1","1","N/A","N/A","N/A","N/A"
"*https://nopaste.net/*",".{0,1000}https\:\/\/nopaste\.net\/.{0,1000}","greyware_tool_keyword","nopaste.net","nopaste.net is a temporary file host - nopaste and clipboard across machines. You can upload files or text and share the link with others - abused by attackers for collection and data exfiltration","T1567.002 - T1036.005 - T1102 - T1071.001","TA0005 - TA0009 - TA0010","N/A","N/A","Data Exfiltration","https://www.shellhub.io/","1","1","#Pastebinlike  #filehostingservice","monitor PUT requests for data exfiltration","8","10","N/A","N/A","N/A","N/A"
"*https://nordvpn.com*/ovpn/*.ovpn*",".{0,1000}https\:\/\/nordvpn\.com.{0,1000}\/ovpn\/.{0,1000}\.ovpn.{0,1000}","greyware_tool_keyword","NordVPN","OVPN configuration for nordvpn accessed within corporate network","T1090.003 - T1133 - T1572","TA0003 - TA0001 - TA0011 - TA0010 - TA0005","N/A","N/A","Data Exfiltration","https://nordvpn.com","0","1","#VPN","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://nsproducts.azureedge.net/nsm-*/NetSupport*",".{0,1000}https\:\/\/nsproducts\.azureedge\.net\/nsm\-.{0,1000}\/NetSupport.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://oshi.at/*",".{0,1000}https\:\/\/oshi\.at\/.{0,1000}","greyware_tool_keyword","OshiUpload","Ephemeral file sharing engine","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Black Basta","Data Exfiltration","https://github.com/somenonymous/OshiUpload","1","1","#filehostingservice #P2P","N/A","10","2","188","26","2022-10-01T04:08:29Z","2019-05-11T02:08:51Z"
"*https://pagekite.net/downloads/*",".{0,1000}https\:\/\/pagekite\.net\/downloads\/.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*https://pagekite.net/pk/src/*",".{0,1000}https\:\/\/pagekite\.net\/pk\/src\/.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*https://portal.ehorus.com/#/agents/*",".{0,1000}https\:\/\/portal\.ehorus\.com\/\#\/agents\/.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://portal.xeox.com/*",".{0,1000}https\:\/\/portal\.xeox\.com\/.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://portr.dev/client/installation/*",".{0,1000}https\:\/\/portr\.dev\/client\/installation\/.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*https://privatebin.net/*",".{0,1000}https\:\/\/privatebin\.net\/.{0,1000}","greyware_tool_keyword","privatebin.net","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with Black Basta victims","T1071.001 - T1567.002 - T1005","TA0010 - TA0009","N/A","Black Basta","Data Exfiltration","N/A","0","1","#PastebinLike","N/A","5","6","N/A","N/A","N/A","N/A"
"*https://privatix-temp-mail-v1.p.rapidapi.com/request/domains/*",".{0,1000}https\:\/\/privatix\-temp\-mail\-v1\.p\.rapidapi\.com\/request\/domains\/.{0,1000}","greyware_tool_keyword","temp-mail","using the API of a disposable email address to use anytime - could be abused by malicious actors","T1071.003","TA0005 - TA0001","N/A","N/A","Defense Evasion","temp-mail.org","1","1","N/A","api doc https://rapidapi.com/Privatix/api/temp-mail","9","10","N/A","N/A","N/A","N/A"
"*https://privatix-temp-mail-v1.p.rapidapi.com/request/mail/id/null/*",".{0,1000}https\:\/\/privatix\-temp\-mail\-v1\.p\.rapidapi\.com\/request\/mail\/id\/null\/.{0,1000}","greyware_tool_keyword","temp-mail","using the API of a disposable email address to use anytime - could be abused by malicious actors","T1071.003","TA0005 - TA0001","N/A","N/A","Defense Evasion","temp-mail.org","1","1","N/A","api doc https://rapidapi.com/Privatix/api/temp-mail","9","10","N/A","N/A","N/A","N/A"
"*https://privnote.com/*",".{0,1000}https\:\/\/privnote\.com\/.{0,1000}","greyware_tool_keyword","privnote.com","temporary notes service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","Akira - Black Basta","Collection","https://github.com/Casualtek/Ransomchats/blob/4a25ac6ad165a4e600aeb72718c3ad41e8f6ce3a/Akira/20240620.json#L31C27-L31C48","1","1","#PastebinLike","downloading files url","5","5","482","50","2025-01-24T16:38:39Z","2023-05-02T16:17:48Z"
"*https://pubsub.zoho.com/*_deskUserPresence/pubsub*",".{0,1000}https\:\/\/pubsub\.zoho\.com\/.{0,1000}_deskUserPresence\/pubsub.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://put.io/?login*",".{0,1000}https\:\/\/put\.io\/\?login.{0,1000}","greyware_tool_keyword","put.io","A storage and torrenting service abused by attackers","T1583.003 - T1071 - T1102","TA0010 - TA0005 - TA0009","N/A","Scattered Spider - RagnarLocker - Medusa","Data Exfiltration","https://put.i","1","1","#filehostingservice #P2P","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://put.io/default/magnet?url=*",".{0,1000}https\:\/\/put\.io\/default\/magnet\?url\=.{0,1000}","greyware_tool_keyword","put.io","A storage and torrenting service abused by attackers","T1583.003 - T1071 - T1102","TA0010 - TA0005 - TA0009","N/A","Scattered Spider - RagnarLocker - Medusa","Collection","https://put.i","1","1","#filehostingservice #P2P","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://put.io/transfers*",".{0,1000}https\:\/\/put\.io\/transfers.{0,1000}","greyware_tool_keyword","put.io","A storage and torrenting service abused by attackers","T1583.003 - T1071 - T1102","TA0010 - TA0005 - TA0009","N/A","Scattered Spider - RagnarLocker - Medusa","Data Exfiltration","https://put.i","1","1","#filehostingservice #P2P","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://put.io/v2/oauth2/register*",".{0,1000}https\:\/\/put\.io\/v2\/oauth2\/register.{0,1000}","greyware_tool_keyword","put.io","A storage and torrenting service abused by attackers","T1583.003 - T1071 - T1102","TA0010 - TA0005 - TA0009","N/A","Scattered Spider - RagnarLocker - Medusa","Data Exfiltration","https://put.i","1","1","#filehostingservice #P2P","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://qaz.im/*",".{0,1000}https\:\/\/qaz\.im\/.{0,1000}","greyware_tool_keyword","qaz.im","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker - Black Basta","Data Exfiltration","https://qaz.im/","1","1","#filehostingservice","uploading files url","10","10","N/A","N/A","N/A","N/A"
"*https://qaz.im/load/*",".{0,1000}https\:\/\/qaz\.im\/load\/.{0,1000}","greyware_tool_keyword","qaz.im","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker - Black Basta","Collection","https://qaz.im/","1","1","#filehostingservice","downloading files url","10","10","N/A","N/A","N/A","N/A"
"*https://qaz.im/zaq/*",".{0,1000}https\:\/\/qaz\.im\/zaq\/.{0,1000}","greyware_tool_keyword","qaz.im","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker - Black Basta","Collection","https://qaz.im/","1","1","#filehostingservice","downloading notes url","10","10","N/A","N/A","N/A","N/A"
"*https://qaz.is/*",".{0,1000}https\:\/\/qaz\.is\/.{0,1000}","greyware_tool_keyword","qaz.is","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker - Black Basta","Data Exfiltration","https://qaz.is/","1","1","#filehostingservice","uploading files url","10","10","N/A","N/A","N/A","N/A"
"*https://qaz.is/load/*",".{0,1000}https\:\/\/qaz\.is\/load\/.{0,1000}","greyware_tool_keyword","qaz.is","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker - Black Basta","Collection","https://qaz.is/","1","1","#filehostingservice","downloading files url","10","10","N/A","N/A","N/A","N/A"
"*https://qaz.is/zaq/*",".{0,1000}https\:\/\/qaz\.is\/zaq\/.{0,1000}","greyware_tool_keyword","qaz.is","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker - Black Basta","Collection","https://qaz.is/","1","1","#filehostingservice","downloading notes url","10","10","N/A","N/A","N/A","N/A"
"*https://qaz.su*",".{0,1000}https\:\/\/qaz\.su.{0,1000}","greyware_tool_keyword","qaz.su","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker - Black Basta","Data Exfiltration","https://qaz.su/","1","1","#filehostingservice","uploading files url","10","10","N/A","N/A","N/A","N/A"
"*https://qaz.su/load/*",".{0,1000}https\:\/\/qaz\.su\/load\/.{0,1000}","greyware_tool_keyword","qaz.su","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker - Black Basta","Collection","https://qaz.su/","1","1","#filehostingservice","downloading files url","10","10","N/A","N/A","N/A","N/A"
"*https://qaz.su/zaq/*",".{0,1000}https\:\/\/qaz\.su\/zaq\/.{0,1000}","greyware_tool_keyword","qaz.su","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker - Black Basta","Collection","https://qaz.su/","1","1","#filehostingservice","downloading notes url","10","10","N/A","N/A","N/A","N/A"
"*https://qu.ax/*.*","https\:\/\/qu\.ax\/[^\s\n]+","greyware_tool_keyword","qu.ax","qu.ax is a quick and private file hosting service - abused by threat actors","T1560.001 - T1190 - T1102 - T1027.002","TA0001 - TA0005 - TA0042","N/A","N/A","Collection","https://qu[.]ax/","1","1","#filehostingservice","N/A","9","10","N/A","N/A","N/A","N/A"
"*https://rclone.org/install.sh*",".{0,1000}https\:\/\/rclone\.org\/install\.sh.{0,1000}","greyware_tool_keyword","rclone","Rclone is a command line program for syncing files with cloud storage services - abused by a lot of ransomware groups","T1567.002 - T1560.001 - T1030 - T1048.002 - T1048.003 - T1567.002 - T1083","TA0010","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - Karakurt - AvosLocker - LockBit - BianLian - Hive - Daixin - Conti - Dagon Locker - Trigona - Quantum - Revil - 8BASE - INC Ransom - Cactus - EvilCorp* - Scattered Spider* - FiveHands - Cinnamon Tempest - EMBER BEA - Gamaredon","Data Exfiltration","https://github.com/rclone/rclone","1","1","N/A","N/A","8","10","49104","4366","2025-02-28T12:22:51Z","2014-03-16T16:19:57Z"
"*https://rdprelay*.support.services.microsoft.com*",".{0,1000}https\:\/\/rdprelay.{0,1000}\.support\.services\.microsoft\.com.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*https://remoteassistance.support.services.microsoft.com/*",".{0,1000}https\:\/\/remoteassistance\.support\.services\.microsoft\.com\/.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*https://remotedesktop.google.com/_/oauthredirect*",".{0,1000}https\:\/\/remotedesktop\.google\.com\/_\/oauthredirect.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://remotedesktop.google.com/headless*",".{0,1000}https\:\/\/remotedesktop\.google\.com\/headless.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://rentry.co/*",".{0,1000}https\:\/\/rentry\.co\/.{0,1000}","greyware_tool_keyword","rentry.co","accessing a pastebinlike site - often abused by malware","T1105 - T1114 - T1083","TA0009","N/A","N/A","Collection","N/A","1","1","#PastebinLike","N/A","5","8","N/A","N/A","N/A","N/A"
"*https://rentry.co/*/raw*",".{0,1000}https\:\/\/rentry\.co\/.{0,1000}\/raw.{0,1000}","greyware_tool_keyword","rentry.co","raw format paste access attempt - abused by attackers to store malicious payloads","T1105 - T1114 - T1083","TA0009","N/A","N/A","Collection","N/A","1","1","#PastebinLike","N/A","7","8","N/A","N/A","N/A","N/A"
"*https://rentry.co/cdn-cgi/challenge-platform/*",".{0,1000}https\:\/\/rentry\.co\/cdn\-cgi\/challenge\-platform\/.{0,1000}","greyware_tool_keyword","rentry.co","raw format paste access attempt - abused by attackers to store malicious payloads","T1105 - T1114 - T1083","TA0009","N/A","N/A","Collection","N/A","1","1","#PastebinLike","N/A","7","8","N/A","N/A","N/A","N/A"
"*https://requestbin.net/r/*",".{0,1000}https\:\/\/requestbin\.net\/r\/.{0,1000}","greyware_tool_keyword","requestbin.net","allows users to create a unique URL to collect and inspect HTTP requests. It is commonly used for debugging webhooks - it can also be abused by attackers for verifying the reachability and effectiveness of their payloads","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","http://requestbin.net","1","1","N/A","Out of band interaction domains","10","10","N/A","N/A","N/A","N/A"
"*https://s3.amazonaws.com/sshx/sshx-*",".{0,1000}https\:\/\/s3\.amazonaws\.com\/sshx\/sshx\-.{0,1000}","greyware_tool_keyword","sshx","Fast collaborative live terminal sharing over the web","T1021.004 - T1041 - T1059 - T1071.001","TA0002 - TA0009 - TA0011 - TA0010","N/A","N/A","C2","https://github.com/ekzhang/sshx","1","1","N/A","N/A","10","10","6284","208","2025-02-12T20:40:30Z","2022-02-12T23:29:33Z"
"*https://s3.filebin.net/filebin/*",".{0,1000}https\:\/\/s3\.filebin\.net\/filebin\/.{0,1000}","greyware_tool_keyword","filebin.net","file hosting platform abused by attackers to host malicious file - raw access and api available","T1119","TA0009","N/A","N/A","Collection","https://filebin.net","1","1","#filehostingservice","N/A","8","8","N/A","N/A","N/A","N/A"
"*https://secure.logmeinrescue.com/R?i=2&Code=*",".{0,1000}https\:\/\/secure\.logmeinrescue\.com\/R\?i\=2\&Code\=.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://secure.logmeinrescue.com/TechnicianConsole/Launch*",".{0,1000}https\:\/\/secure\.logmeinrescue\.com\/TechnicianConsole\/Launch.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://send.exploit.in/api/download*",".{0,1000}https\:\/\/send\.exploit\.in\/api\/download.{0,1000}","greyware_tool_keyword","send.exploit.in","downloading files - hosting service frequently exploited by attackers - should be blocked","T1567 - T1071 - T1020 - T1005","TA0010 - TA0009","N/A","LockBit - Hive - Black Basta","Collection","N/A","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://send.exploit.in/api/info/*",".{0,1000}https\:\/\/send\.exploit\.in\/api\/info\/.{0,1000}","greyware_tool_keyword","send.exploit.in","uploading files - hosting service frequently exploited by attackers - should be blocked","T1567 - T1071 - T1020 - T1005","TA0010 - TA0009","N/A","LockBit - Hive - Black Basta","Data Exfiltration","N/A","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://send.exploit.in/api/metadata/*",".{0,1000}https\:\/\/send\.exploit\.in\/api\/metadata\/.{0,1000}","greyware_tool_keyword","send.exploit.in","uploading files - hosting service frequently exploited by attackers - should be blocked","T1567 - T1071 - T1020 - T1005","TA0010 - TA0009","N/A","LockBit - Hive - Black Basta","Data Exfiltration","N/A","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://senet-flets.v6.softether.co.jp/ddns/ddns.aspx*",".{0,1000}https\:\/\/senet\-flets\.v6\.softether\.co\.jp\/ddns\/ddns\.aspx.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*https://share.riseup.net/2*",".{0,1000}https\:\/\/share\.riseup\.net\/2.{0,1000}","greyware_tool_keyword","share.riseup.net","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker","Collection","https://share.riseup.net","1","1","#filehostingservice","downloading files url","10","10","N/A","N/A","N/A","N/A"
"*https://share.riseup.net/up*",".{0,1000}https\:\/\/share\.riseup\.net\/up.{0,1000}","greyware_tool_keyword","share.riseup.net","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","AvosLocker","Data Exfiltration","https://share.riseup.net","1","1","#filehostingservice","uploading files url","10","10","N/A","N/A","N/A","N/A"
"*https://silentbreaksecurity.com/adaptive-dll-hijacking*",".{0,1000}https\:\/\/silentbreaksecurity\.com\/adaptive\-dll\-hijacking.{0,1000}","greyware_tool_keyword","IObitUnlocker","unlocking locked files on Windows systems","T1222 - T1070 - T1485","TA0005 - TA0040","N/A","PLAY","Defense Evasion","https://www.iobit.com/en/iobit-unlocker.php#","1","1","N/A","often used legitimatly - admin tool","5","9","N/A","N/A","N/A","N/A"
"*https://slack.com/api/channels.create*",".{0,1000}https\:\/\/slack\.com\/api\/channels\.create.{0,1000}","greyware_tool_keyword","slack","API usage of slack - creating channel - abused by multiple C2","T1059.003 - T1071.004 - T1562.001","TA0002 - TA0010 - TA0011","N/A","N/A","C2","https://github.com/mthcht/Purpleteam/blob/main/Detection/Threat%20Hunting/generic/C2_abusing_API_services.md","0","1","N/A","/!\ very high risk of FP - hunting only","1","2","180","19","2024-12-20T10:22:25Z","2022-12-05T12:40:02Z"
"*https://spark.adobe.com/page/*",".{0,1000}https\:\/\/spark\.adobe\.com\/page\/.{0,1000}","greyware_tool_keyword","adobe.com","Attackers can use adobe.com to masquerade their domain for phishing purposes.","T1204.002 - T1036 - T1566.002","TA0001 - TA0005","N/A","N/A","Defense Evasion","https://www.joesandbox.com/analysis/515360/0/html","0","1","N/A","N/A","1","1","N/A","N/A","N/A","N/A"
"*https://sshx.io/get*",".{0,1000}https\:\/\/sshx\.io\/get.{0,1000}","greyware_tool_keyword","sshx","Fast collaborative live terminal sharing over the web","T1021.004 - T1041 - T1059 - T1071.001","TA0002 - TA0009 - TA0011 - TA0010","N/A","N/A","C2","https://github.com/ekzhang/sshx","1","1","N/A","N/A","10","10","6284","208","2025-02-12T20:40:30Z","2022-02-12T23:29:33Z"
"*https://sshx.io/s/*",".{0,1000}https\:\/\/sshx\.io\/s\/.{0,1000}","greyware_tool_keyword","sshx","Fast collaborative live terminal sharing over the web","T1021.004 - T1041 - T1059 - T1071.001","TA0002 - TA0009 - TA0011 - TA0010","N/A","N/A","C2","https://github.com/ekzhang/sshx","1","1","N/A","N/A","10","10","6284","208","2025-02-12T20:40:30Z","2022-02-12T23:29:33Z"
"*https://steamcommunity.com/profiles/*",".{0,1000}https\:\/\/steamcommunity\.com\/profiles\/.{0,1000}","greyware_tool_keyword","steam","Steam profiles have been leveraged to host payload addresses for malware delivery - making them a potential threat vector in corporate environments. This tactic can serve as a valuable hunting tip for threat detection efforts","T1102 - T1091 - T1204","TA0001 - TA0009","Lumma Stealer","N/A","Collection","N/A","0","1","N/A","N/A","1","1","N/A","N/A","N/A","N/A"
"*https://store-*.ufile.io/v1/upload/*",".{0,1000}https\:\/\/store\-.{0,1000}\.ufile\.io\/v1\/upload\/.{0,1000}","greyware_tool_keyword","ufile.io","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","Hive","Data Exfiltration","https://ufile.io","1","1","N/A","uploading files url","10","10","N/A","N/A","N/A","N/A"
"*https://sun.aweray.com/*/download*",".{0,1000}https\:\/\/sun\.aweray\.com\/.{0,1000}\/download.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://tailscale.com/s/resolvconf-overwrite*",".{0,1000}https\:\/\/tailscale\.com\/s\/resolvconf\-overwrite.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*https://temp.sh/*/*",".{0,1000}https\:\/\/temp\.sh\/.{0,1000}\/.{0,1000}","greyware_tool_keyword","temp.sh","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","Black Basta","Collection","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://temp.sh/upload*",".{0,1000}https\:\/\/temp\.sh\/upload.{0,1000}","greyware_tool_keyword","temp.sh","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","Black Basta","Data Exfiltration","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://tempsend.com/*",".{0,1000}https\:\/\/tempsend\.com\/.{0,1000}","greyware_tool_keyword","tempsend.com","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","N/A","Collection","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://tempsend.com/send*",".{0,1000}https\:\/\/tempsend\.com\/send.{0,1000}","greyware_tool_keyword","tempsend.com","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","N/A","Data Exfiltration","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://termbin.com/test*",".{0,1000}https\:\/\/termbin\.com\/test.{0,1000}","greyware_tool_keyword","termbin.com","accessing paste raw content","T1119","TA0009","N/A","N/A","Collection","termbin.com","1","1","N/A","N/A","8","8","N/A","N/A","N/A","N/A"
"*https://textbin.net/raw/*",".{0,1000}https\:\/\/textbin\.net\/raw\/.{0,1000}","greyware_tool_keyword","textbin.net","textbin.net raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","textbin.net","1","1","#PastebinLike","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://tmate.io/t/*",".{0,1000}https\:\/\/tmate\.io\/t\/.{0,1000}","greyware_tool_keyword","tmate","Instant terminal sharing","T1071 - T1105 - T1573 - T1021","TA0010 - TA0011 - TA0008 - TA0002","N/A","WatchDog","C2","https://github.com/tmate-io/tmate","1","1","#linux","N/A","10","10","5755","312","2023-10-16T11:59:37Z","2013-06-12T20:29:22Z"
"*https://tmpfiles.org/dl/*.exe*",".{0,1000}https\:\/\/tmpfiles\.org\/dl\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","tmpfiles.org","download of an executable files from tmpfiles.org often used by ransomware groups","T1566.002 - T1192 - T1105","TA0001 - TA0002","N/A","N/A","Collection","N/A","1","1","#filehostingservice","greyware tool - risk of false positive !","10","10","N/A","N/A","N/A","N/A"
"*https://tox.chat/download.html*",".{0,1000}https\:\/\/tox\.chat\/download\.html.{0,1000}","greyware_tool_keyword","ransomware_notes","detection patterns retrieved in ransomware notes archives","T1486","TA0040","N/A","N/A","Ransomware","https://github.com/threatlabz/ransomware_notes","1","1","N/A","N/A","10","4","342","52","2025-02-18T18:47:47Z","2022-08-01T15:14:59Z"
"*https://track.adform.net/C/?bn=*;cpdir=http*",".{0,1000}https\:\/\/track\.adform\.net\/C\/\?bn\=.{0,1000}\;cpdir\=http.{0,1000}","greyware_tool_keyword","track.adform.net","Attackers can use track.adform.net to masquerade their domain for phishing purposes.","T1204.002 - T1036 - T1566.002","TA0001 - TA0005","N/A","N/A","Defense Evasion","https://www.joesandbox.com/analysis/514456/0/html","0","1","N/A","N/A","5","5","N/A","N/A","N/A","N/A"
"*https://transfer.sh*",".{0,1000}https\:\/\/transfer\.sh.{0,1000}","greyware_tool_keyword","transfer.sh","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","Black Basta","Data Exfiltration","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://transfert-my-files.com/files/*",".{0,1000}https\:\/\/transfert\-my\-files\.com\/files\/.{0,1000}","greyware_tool_keyword","transfert-my-files.com","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","N/A","Collection","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://transfert-my-files.com/inc/upload.php*",".{0,1000}https\:\/\/transfert\-my\-files\.com\/inc\/upload\.php.{0,1000}","greyware_tool_keyword","transfert-my-files.com","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","N/A","Data Exfiltration","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://tunnel.pyjam.as/*",".{0,1000}https\:\/\/tunnel\.pyjam\.as\/.{0,1000}","greyware_tool_keyword","tunnel","SSL-terminated ephemeral HTTP tunnels to your local machine","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://gitlab.com/pyjam.as/tunnel","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://tunnelmole.com/docs*",".{0,1000}https\:\/\/tunnelmole\.com\/docs.{0,1000}","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*https://tunwg.com*",".{0,1000}https\:\/\/tunwg\.com.{0,1000}","greyware_tool_keyword","tunwg","End to end encrypted secure tunnel to local servers","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ntnj/tunwg","1","1","N/A","N/A","10","10","233","9","2024-09-18T15:03:45Z","2023-01-16T17:51:13Z"
"*https://ufile.io/*",".{0,1000}https\:\/\/ufile\.io\/.{0,1000}","greyware_tool_keyword","ufile.io","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","Hive","Collection","https://ufile.io","1","1","N/A","downloading files url","5","6","N/A","N/A","N/A","N/A"
"*https://ufile.io/v1/upload/*",".{0,1000}https\:\/\/ufile\.io\/v1\/upload\/.{0,1000}","greyware_tool_keyword","ufile.io","temporary file hosting service - abused by attackers to share informations with their victims","T1105 - T1071","TA0010 - TA0009","N/A","Hive","Data Exfiltration","https://ufile.io","1","1","#filehostingservice","uploading files url","10","10","N/A","N/A","N/A","N/A"
"*https://update.lansweeper.com/installation.aspx*",".{0,1000}https\:\/\/update\.lansweeper\.com\/installation\.aspx.{0,1000}","greyware_tool_keyword","Lansweeper","Lansweeper discovers and inventories IT assets - gathering system - software and user data - abused by attackers","T1016 - T1082","TA0007","N/A","EvilCorp*","Discovery","https://www.lansweeper.com/","1","1","N/A","N/A","6","7","N/A","N/A","N/A","N/A"
"*https://us4-wms6.zoho.com*",".{0,1000}https\:\/\/us4\-wms6\.zoho\.com.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://usaupload.com/account/ajax/load_files*",".{0,1000}https\:\/\/usaupload\.com\/account\/ajax\/load_files.{0,1000}","greyware_tool_keyword","usaupload","uploading files to usaupload","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","N/A","Data Exfiltration","https://usaupload.com/","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://usaupload.com/account/ajax/uploader*",".{0,1000}https\:\/\/usaupload\.com\/account\/ajax\/uploader.{0,1000}","greyware_tool_keyword","usaupload","uploading files to usaupload","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","N/A","Data Exfiltration","https://usaupload.com/","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://we.tl/t-*",".{0,1000}https\:\/\/we\.tl\/t\-.{0,1000}","greyware_tool_keyword","wetransfer","WeTransfer is a popular file sharing service often used by malicious actors for phishing campaigns due to its legitimate reputation and widespread use even within some enterprises to share files","T1608.001 - T1566 - T1002 - T1048 - T1204","TA0001 - TA0002 - TA0010","N/A","EXOTIC LILY","Phishing","https://twitter.com/mthcht/status/1658853848323182597","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://webhook.site/*-*-*-*",".{0,1000}https\:\/\/webhook\.site\/.{0,1000}\-.{0,1000}\-.{0,1000}\-.{0,1000}","greyware_tool_keyword","webhook.site","test HTTP webhooks with this handy tool that displays requests instantly - abused by attacker for payload callback confirmation","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/webhooksite/webhook.site","1","1","N/A","Out of band interaction domains","10","10","5694","441","2024-10-16T08:45:00Z","2016-03-21T08:45:42Z"
"*https://wetransfer.com/api/v4/transfers/*",".{0,1000}https\:\/\/wetransfer\.com\/api\/v4\/transfers\/.{0,1000}","greyware_tool_keyword","wetransfer","WeTransfer is a popular file-sharing service often used by malicious actors for phishing campaigns due to its legitimate reputation and widespread use even within some enterprises to share files","T1608.001 - T1566 - T1002 - T1048 - T1204","TA0001 - TA0002 - TA0010","N/A","EXOTIC LILY","Phishing","https://twitter.com/mthcht/status/1658853848323182597","1","1","#filehostingservice","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://wetransfer.com/downloads/*",".{0,1000}https\:\/\/wetransfer\.com\/downloads\/.{0,1000}","greyware_tool_keyword","wetransfer","WeTransfer is a popular file-sharing service often used by malicious actors for phishing campaigns due to its legitimate reputation and widespread use even within some enterprises to share files","T1608.001 - T1566 - T1002 - T1048 - T1204","TA0001 - TA0002 - TA0010","N/A","EXOTIC LILY","Phishing","https://twitter.com/mthcht/status/1658853848323182597","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://www.4shared.com/get/*",".{0,1000}https\:\/\/www\.4shared\.com\/get\/.{0,1000}","greyware_tool_keyword","4shared.com","Downloading a file from 4shared.com","T1105 - T1071 - T1125","TA0009","N/A","Turla","Collection","4shared.com","1","1","#filehostingservice","N/A","6","5","N/A","N/A","N/A","N/A"
"*https://www.autohotkey.com/download/*",".{0,1000}https\:\/\/www\.autohotkey\.com\/download\/.{0,1000}","greyware_tool_keyword","Ahk2Exe","Official AutoHotkey script compiler - misused in scripting malicious executables","T1059 - T1204 - T1036 - T1027","TA0002 - TA0005","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/Ahk2Exe","1","1","N/A","N/A","7","7","644","118","2024-08-10T23:15:47Z","2011-08-01T10:28:19Z"
"*https://www.btunnel.in/downloads*",".{0,1000}https\:\/\/www\.btunnel\.in\/downloads.{0,1000}","greyware_tool_keyword","btunnel","Btunnel is a publicly accessible reverse proxy","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://www.btunnel.in","1","1","N/A","N/A","9","8","N/A","N/A","N/A","N/A"
"*https://www.dataplicity.com/*.py*",".{0,1000}https\:\/\/www\.dataplicity\.com\/.{0,1000}\.py.{0,1000}","greyware_tool_keyword","Dataplicity","enables connecting local systems to dataplicity cloud for remotely accessing them over the internet.","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/wildfoundry/dataplicity-agent","1","1","N/A","N/A","9","2","167","32","2024-06-10T20:17:43Z","2016-07-27T14:23:01Z"
"*https://www.duckdns.org/update?domains=*",".{0,1000}https\:\/\/www\.duckdns\.org\/update\?domains\=.{0,1000}","greyware_tool_keyword","duckdns.org","A simple C# DuckDNS updater - free dynamic DNS hosted on AWS - often used by threat actors for contacting C2","T1568.002 - T1071.001","TA0011 - TA0005","N/A","N/A","Defense Evasion","https://www.duckdns.org/install.jsp","1","1","N/A","N/A","5","10","N/A","N/A","N/A","N/A"
"*https://www.email-format.com/d/*",".{0,1000}https\:\/\/www\.email\-format\.com\/d\/.{0,1000}","greyware_tool_keyword","email-format","used by attackers to find informations about a company users","T1593 - T1596 - T1213","TA0009","N/A","N/A","Reconnaissance","https://www.email-format.com","1","1","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://www.guerrillamail.com/compose*",".{0,1000}https\:\/\/www\.guerrillamail\.com\/compose.{0,1000}","greyware_tool_keyword","guerrillamail","disposable email address to use anytime.","T1071.003","TA0005 - TA0001","N/A","N/A","Defense Evasion","https://www.guerrillamail.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://www.guerrillamail.com/inbox*",".{0,1000}https\:\/\/www\.guerrillamail\.com\/inbox.{0,1000}","greyware_tool_keyword","guerrillamail","disposable email address to use anytime.","T1071.003","TA0005 - TA0001","N/A","N/A","Defense Evasion","https://www.guerrillamail.com","1","1","N/A","N/A","8","9","N/A","N/A","N/A","N/A"
"*https://www.lansweeper.com/installation.aspx*",".{0,1000}https\:\/\/www\.lansweeper\.com\/installation\.aspx.{0,1000}","greyware_tool_keyword","Lansweeper","Lansweeper discovers and inventories IT assets - gathering system - software and user data - abused by attackers","T1016 - T1082","TA0007","N/A","EvilCorp*","Discovery","https://www.lansweeper.com/","1","1","N/A","N/A","6","7","N/A","N/A","N/A","N/A"
"*https://www.majorgeeks.com/files/details/pc_hunter.html*",".{0,1000}https\:\/\/www\.majorgeeks\.com\/files\/details\/pc_hunter\.html.{0,1000}","greyware_tool_keyword","PCHunter","PCHunter is a toolkit offering deep access to kernel setting - processes - network  and startup configurations. It is designed to detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","LockBit - Conti - 8BASE - TargetCompany - Hive - Qilin","Defense Evasion","https://www.majorgeeks.com/files/details/pc_hunter.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://www.mediafire.com/api/*/folder/get_content.php*",".{0,1000}https\:\/\/www\.mediafire\.com\/api\/.{0,1000}\/folder\/get_content\.php.{0,1000}","greyware_tool_keyword","mediafire","downloading from mediafire","T1105 - T1114 - T1083","TA0009","N/A","Black Basta","Collection","N/A","1","1","#filehostingservice","N/A","7","8","N/A","N/A","N/A","N/A"
"*https://www.nirsoft.net/toolsdownload/*",".{0,1000}https\:\/\/www\.nirsoft\.net\/toolsdownload\/.{0,1000}","greyware_tool_keyword","nirsoft tools","NirSoft is a legitimate software company that develops system utilities for Windows. Some of its tools can be used by malicious actors to recover passwords harvest sensitive information and conduct password attacks.","T1003 - T1003.001 - T1003.002 - T1110 - T1566","TA0002 - TA0003 - TA0004 - TA0006 - TA0007 - TA0008 - TA0011","N/A","N/A","Collection","N/A","1","1","N/A","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://www.nirsoft.net/toolsdownload/*.exe*",".{0,1000}https\:\/\/www\.nirsoft\.net\/toolsdownload\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","nirsoft tools","some of nirsoft tools can be abused by attackers to retrieve passwords ","T1003 - T1021 - T1056 - T1110 - T1212 - T1552","TA0001 - TA0002 - TA0003 - TA0005 - TA0006 - TA0007 - TA0011","N/A","N/A","Credential Access","nirsoft.net","1","1","N/A","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://www.nirsoft.net/toolsdownload/*.zip*",".{0,1000}https\:\/\/www\.nirsoft\.net\/toolsdownload\/.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","nirsoft tools","some of nirsoft tools can be abused by attackers to retrieve passwords ","T1003 - T1021 - T1056 - T1110 - T1212 - T1552","TA0001 - TA0002 - TA0003 - TA0005 - TA0006 - TA0007 - TA0011","N/A","N/A","Credential Access","nirsoft.net","1","1","N/A","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://www.nirsoft.net/utils/*.exe*",".{0,1000}https\:\/\/www\.nirsoft\.net\/utils\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","nirsoft tools","some of nirsoft tools can be abused by attackers to retrieve passwords ","T1003 - T1021 - T1056 - T1110 - T1212 - T1552","TA0001 - TA0002 - TA0003 - TA0005 - TA0006 - TA0007 - TA0011","N/A","N/A","Credential Access","nirsoft.net","1","1","N/A","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://www.nirsoft.net/utils/*.zip*",".{0,1000}https\:\/\/www\.nirsoft\.net\/utils\/.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","nirsoft tools","some of nirsoft tools can be abused by attackers to retrieve passwords ","T1003 - T1021 - T1056 - T1110 - T1212 - T1552","TA0001 - TA0002 - TA0003 - TA0005 - TA0006 - TA0007 - TA0011","N/A","N/A","Credential Access","nirsoft.net","1","1","N/A","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://www.premiumize.me/*",".{0,1000}https\:\/\/www\.premiumize\.me\/.{0,1000}","greyware_tool_keyword","premiumize.me","hosting service abused by attackers","T1583.003 - T1071 - T1102","TA0010 - TA0005 - TA0009","N/A","N/A","Collection","www.premiumize.me","1","1","#filehostingservice #P2P","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://www.sendspace.com/delete*",".{0,1000}https\:\/\/www\.sendspace\.com\/delete.{0,1000}","greyware_tool_keyword","sendspace.com","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","Dispossessor - Black Basta - Hive - Ragnar Locker - Royal - LockBit - Vice Society","Collection","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://www.sendspace.com/file/*",".{0,1000}\shttps\:\/\/www\.sendspace\.com\/file\/.{0,1000}","greyware_tool_keyword","sendspace.com","Interesting observation on the file-sharing platform preferences derived from the negotiations chats with LockBit victims","T1567 - T1022 - T1074 - T1105","TA0011 - TA0009 - TA0010 - TA0008","N/A","Dispossessor - Black Basta - Hive - Ragnar Locker - Royal - LockBit - Vice Society","Collection","https://twitter.com/mthcht/status/1660953897622544384","1","1","#filehostingservice","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*https://www.skymem.info/srch?q=*",".{0,1000}https\:\/\/www\.skymem\.info\/srch\?q\=.{0,1000}","greyware_tool_keyword","skymen.info","used by attackers to find informations about a company users","T1593 - T1596 - T1213","TA0009","N/A","N/A","Reconnaissance","https://www.skymem.info","1","1","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
"*https://www.softether-download.com/*",".{0,1000}https\:\/\/www\.softether\-download\.com\/.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*https://www.softperfect.com/download/files/netscan*",".{0,1000}https\:\/\/www\.softperfect\.com\/download\/files\/netscan.{0,1000}","greyware_tool_keyword","softperfect networkscanner","SoftPerfect Network Scanner can ping computers scan ports discover shared folders and retrieve practically any information about network devices via WMI SNMP HTTP SSH and PowerShell","T1046 - T1065 - T1135 ","TA0007 ","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - LockBit - BianLian - Conti - BlackCat - Dagon Locker - Nokoyawa - Trigona - Hive - BlackByte - RansomHub - Cactus - Fog - Medusa - Avaddon - Cobalt Group - FIN7 - Anunak","Discovery","https://www.softperfect.com/products/networkscanner/","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://www.softperfect.com/products/networkscanner/?from=nver*",".{0,1000}https\:\/\/www\.softperfect\.com\/products\/networkscanner\/\?from\=nver.{0,1000}","greyware_tool_keyword","softperfect networkscanner","SoftPerfect Network Scanner can ping computers scan ports discover shared folders and retrieve practically any information about network devices via WMI SNMP HTTP SSH and PowerShell","T1046 - T1065 - T1135 ","TA0007 ","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - LockBit - BianLian - Conti - BlackCat - Dagon Locker - Nokoyawa - Trigona - Hive - BlackByte - RansomHub - Cactus - Fog - Medusa - Avaddon - Cobalt Group - FIN7 - Anunak","Discovery","https://www.softperfect.com/products/networkscanner/","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*https://www.telerik.com/download/fiddler/*",".{0,1000}https\:\/\/www\.telerik\.com\/download\/fiddler\/.{0,1000}","greyware_tool_keyword","fiddler","fiddler - capture https requests","T1056 - T1040 - T1557","TA0009 - TA00010","N/A","N/A","Collection","https://www.telerik.com/","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*https://www.wireguard.com/install*",".{0,1000}https\:\/\/www\.wireguard\.com\/install.{0,1000}","greyware_tool_keyword","tunnel","SSL-terminated ephemeral HTTP tunnels to your local machine","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://gitlab.com/pyjam.as/tunnel","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://www.wireguard.com/install*",".{0,1000}https\:\/\/www\.wireguard\.com\/install.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","Defense Evasion","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*https://zerobin.net/?*",".{0,1000}https\:\/\/zerobin\.net\/\?.{0,1000}","greyware_tool_keyword","zerobin.net","accessing paste raw content","T1119","TA0009","N/A","N/A","Collection","https://zerobin.net/","1","1","#PastebinLike","N/A","8","8","N/A","N/A","N/A","N/A"
"*https://zerobin.net/js/privatebin.js*",".{0,1000}https\:\/\/zerobin\.net\/js\/privatebin\.js.{0,1000}","greyware_tool_keyword","zerobin.net","sending data to a pastebin","T1567.002","TA0010","N/A","N/A","Data Exfiltration","https://zerobin.net/","1","1","#PastebinLike","N/A","8","8","N/A","N/A","N/A","N/A"
"*https://zrok.*",".{0,1000}https\:\/\/zrok\..{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*hub.ehorus.com",".{0,1000}hub\.ehorus\.com","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*humphd/VncSharp*",".{0,1000}humphd\/VncSharp.{0,1000}","greyware_tool_keyword","VncSharp","VncSharp is a GPL implementation of the VNC Remote Framebuffer (RFB) Protocol for the .NET Framework","T1021.001 - T1219  - T1071.001","TA0007 - TA0008","Carbanak","FIN7 - Carbanak","Lateral Movement","https://github.com/humphd/VncSharp","1","1","N/A","N/A","8","3","246","177","2019-02-18T16:04:27Z","2012-03-05T15:23:41Z"
"*hypertunnel.lvh.me*",".{0,1000}hypertunnel\.lvh\.me.{0,1000}","greyware_tool_keyword","hypertunnel","Expose any local TCP/IP service on the internet","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/berstend/hypertunnel","1","1","N/A","N/A","10","10","246","47","2022-12-08T19:13:24Z","2018-06-11T05:29:58Z"
"*hypertunnel-server@latest*",".{0,1000}hypertunnel\-server\@latest.{0,1000}","greyware_tool_keyword","hypertunnel","Expose any local TCP/IP service on the internet","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/berstend/hypertunnel","1","1","N/A","N/A","10","10","246","47","2022-12-08T19:13:24Z","2018-06-11T05:29:58Z"
"*identify_offensive_tools.ps1*",".{0,1000}identify_offensive_tools\.ps1.{0,1000}","greyware_tool_keyword","redpill","Assist reverse tcp shells in post-exploration tasks","T1082 - T1016 - T1049 - T1057 - T1489 - T1070 - T1562 - T1563 - T1119 - T1518 - T1602 - T1530 - T1113 - T1125 - T1105 - T1133 - T1056 - T1114 - T1539 - T1552 - T1214 - T1110 - T1040 - T1436 - T1068 - T1088 - T1564 - T1112 - T1547 - T1574 - T1204 - T1215 - T1046 - T1557 - T1136 - T1059 - T1127 - T1555 - T1548 - T1115 - T1003","TA0007 - TA0003 - TA0005 - TA0009 - TA0002 - TA0006 - TA0004 - TA0010 - TA0011","N/A","N/A","Exploitation tool","https://github.com/r00t-3xp10it/redpill","1","1","N/A","N/A","10","3","216","52","2024-03-19T15:03:16Z","2021-02-20T23:59:07Z"
"*inc1.rel.tunnels.api.visualstudio.com*",".{0,1000}inc1\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*inconshreveable/ngrok*",".{0,1000}inconshreveable\/ngrok.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","N/A","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*info.meshcentral.com*",".{0,1000}info\.meshcentral\.com.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*infrastructure/remotemoe.service*",".{0,1000}infrastructure\/remotemoe\.service.{0,1000}","greyware_tool_keyword","remotemoe","remotemoe is a software daemon for exposing ad-hoc services to the internet without having to deal with the regular network stuff such as configuring VPNs - changing firewalls - or adding port forwards","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/fasmide/remotemoe","1","1","N/A","N/A","10","10","284","32","2024-06-03T14:00:47Z","2020-06-11T07:41:03Z"
"*inomeogfingihgjfjlpeplalcfajhgai*",".{0,1000}inomeogfingihgjfjlpeplalcfajhgai.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*install.tunnelmole.com",".{0,1000}install\.tunnelmole\.com","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*interactsh*.exe",".{0,1000}interactsh.{0,1000}\.exe","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C9","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*interactsh*oast.*",".{0,1000}interactsh.{0,1000}oast\..{0,1000}","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C14","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*Invoke-ADRecon*",".{0,1000}Invoke\-ADRecon.{0,1000}","greyware_tool_keyword","adrecon","ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.","T1018 - T1087.001 - T1069.001 - T1003.002 - T1482","TA0007 - TA0009 - TA0040","N/A","Scattered Spider*","Discovery","https://github.com/adrecon/ADRecon","1","1","N/A","AD Enumeration","7","8","755","107","2024-10-15T03:41:29Z","2018-12-15T13:00:09Z"
"*Invoke-Maldaptive*",".{0,1000}Invoke\-Maldaptive.{0,1000}","greyware_tool_keyword","Invoke-Maldaptive","MaLDAPtive is a framework for LDAP SearchFilter parsing - obfuscation - deobfuscation and detection.","T1027","TA0005 - TA0007","N/A","N/A","Discovery","https://github.com/MaLDAPtive/Invoke-Maldaptive","1","1","N/A","N/A","7","3","261","24","2024-08-07T21:12:45Z","2024-08-07T20:43:52Z"
"*ip.remotepc.com*",".{0,1000}ip\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","network","10","10","N/A","N/A","N/A","N/A"
"*ipscan-win64-*.exe*",".{0,1000}ipscan\-win64\-.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","ipscan","Angry IP Scanner - fast and friendly network scanner - abused by a lot ransomware actors","T1046 - T1040 - T1018","TA0007 - TA0009","N/A","Phobos - BERSERK BEAR","Discovery","https://github.com/angryip/ipscan","1","1","N/A","N/A","7","10","4333","743","2024-11-23T19:03:47Z","2011-06-28T20:58:48Z"
"*jerson/tap/pgrok*",".{0,1000}jerson\/tap\/pgrok.{0,1000}","greyware_tool_keyword","pgrok","Poor man's ngrok - a multi-tenant HTTP/TCP reverse tunnel solution through SSH remote port forwarding","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pgrok/pgrok","1","1","N/A","N/A","10","10","3263","112","2025-03-01T08:52:06Z","2023-03-08T12:43:55Z"
"*jzelinskie/duckdns*",".{0,1000}jzelinskie\/duckdns.{0,1000}","greyware_tool_keyword","duckdns.org","A simple C# DuckDNS updater - free dynamic DNS hosted on AWS - often used by threat actors for contacting C2","T1568.002 - T1071.001","TA0011 - TA0005","N/A","N/A","Defense Evasion","https://www.duckdns.org/install.jsp","1","1","N/A","N/A","5","10","N/A","N/A","N/A","N/A"
"*kaichaosun/rlt*",".{0,1000}kaichaosun\/rlt.{0,1000}","greyware_tool_keyword","Rust Localtunnels","Localtunnel implementation in Rust - exposes your localhost endpoint to the world","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/kaichaosun/rlt","1","1","N/A","N/A","7","2","113","13","2024-12-16T09:09:34Z","2022-06-27T05:57:34Z"
"*kavika13/RemCom*",".{0,1000}kavika13\/RemCom.{0,1000}","greyware_tool_keyword","RemCom","Remote Command Executor: A OSS replacement for PsExec and RunAs","T1077 - T1059 - T1021 - T1569.002","TA0002 - TA0005 - TA0008","N/A","APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando ","Lateral Movement","https://github.com/kavika13/RemCom","1","1","N/A","N/A","10","4","344","97","2017-10-30T04:48:38Z","2011-11-09T11:00:09Z"
"*KimiNewt/pyshark*",".{0,1000}KimiNewt\/pyshark.{0,1000}","greyware_tool_keyword","pyshark","Python wrapper for tshark allowing python packet parsing using wireshark dissectors","T1040 - T1213 - T1105 - T1572","TA0009 - TA0007","N/A","N/A","Discovery","https://github.com/KimiNewt/pyshark","1","1","N/A","N/A","6","10","2332","435","2024-12-04T15:41:20Z","2013-12-28T14:38:22Z"
"*lansearchpro_portable.zip*",".{0,1000}lansearchpro_portable\.zip.{0,1000}","greyware_tool_keyword","advanced port scanner","port scanner tool abused by ransomware actors","T1135 - T1021 - T1016 - T1046","TA0007 - TA0043","N/A","Dispossessor - LockBit - BianLian - PYSA - Trigona - EvilCorp* - Fog - Scattered Spider* - INDRIK SPIDER - Medusa Locker","Discovery","https://www.advanced-port-scanner.com/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*lansearchpro_setup.exe*",".{0,1000}lansearchpro_setup\.exe.{0,1000}","greyware_tool_keyword","advanced port scanner","port scanner tool abused by ransomware actors","T1135 - T1021 - T1016 - T1046","TA0007 - TA0043","N/A","Dispossessor - LockBit - BianLian - PYSA - Trigona - EvilCorp* - Fog - Scattered Spider* - INDRIK SPIDER - Medusa Locker","Discovery","https://www.advanced-port-scanner.com/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*launcher-rest-new.live.corecollab.ucc-prod.eva.goto.com*",".{0,1000}launcher\-rest\-new\.live\.corecollab\.ucc\-prod\.eva\.goto\.com.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*L-codes/LTProxy*",".{0,1000}L\-codes\/LTProxy.{0,1000}","greyware_tool_keyword","LTProxy","Linux Transparent Proxy (Similar to Proxifiter)","T1090 - T1573.001 - T1571 - T1071.001","TA0010 - TA0005","N/A","N/A","Data Exfiltration","https://github.com/L-codes/LTProxy","1","1","#linux","N/A","10","1","31","5","2024-11-27T05:09:47Z","2021-11-11T15:17:54Z"
"*L-codes/Neo-reGeorg*",".{0,1000}L\-codes\/Neo\-reGeorg.{0,1000}","greyware_tool_keyword","Neo-reGeorg","Neo-reGeorg is a project that seeks to aggressively refactor reGeorg","T1090 - T1095 - T1572","TA0003 - TA0011 - TA0005 - TA0010","N/A","IRIDIUM","Data Exfiltration","https://github.com/L-codes/Neo-reGeorg","1","1","N/A","N/A","10","10","2994","452","2025-02-18T07:26:54Z","2019-07-08T14:25:42Z"
"*libwireshark16*",".{0,1000}libwireshark16.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*libwireshark-data*",".{0,1000}libwireshark\-data.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*libwireshark-dev*",".{0,1000}libwireshark\-dev.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*libwiretap13*",".{0,1000}libwiretap13.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*license.bomgar.com*",".{0,1000}license\.bomgar\.com.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*LMI_RescueRC.exe*",".{0,1000}LMI_RescueRC\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*LMIGuardianSvc.exe*",".{0,1000}LMIGuardianSvc\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*localhost:4782*",".{0,1000}localhost\:4782.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","9032","2528","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*localtunnel.github.io/www/*",".{0,1000}localtunnel\.github\.io\/www\/.{0,1000}","greyware_tool_keyword","localtunnels","server for localtunnel.me - localtunnel exposes your localhost to the world for easy testing and sharing","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/localtunnel/server","1","1","N/A","N/A","8","10","3139","1022","2024-03-20T09:14:46Z","2013-06-16T22:30:48Z"
"*localtunnel/go-localtunnel*",".{0,1000}localtunnel\/go\-localtunnel.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/NoahShen/gotunnelme","1","1","N/A","N/A","10","10","170","46","2018-01-06T04:41:15Z","2013-10-18T02:46:51Z"
"*localtunnel/localtunnel*",".{0,1000}localtunnel\/localtunnel.{0,1000}","greyware_tool_keyword","localtunnels","client for localtunnel.me - localtunnel exposes your localhost to the world for easy testing and sharing","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/localtunnel/localtunnel","1","1","N/A","N/A","8","10","20234","1399","2024-03-20T17:04:54Z","2012-06-18T02:33:30Z"
"*localtunnel/nginx*",".{0,1000}localtunnel\/nginx.{0,1000}","greyware_tool_keyword","localtunnels","server for localtunnel.me - localtunnel exposes your localhost to the world for easy testing and sharing","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/localtunnel/server","1","1","N/A","N/A","8","10","3139","1022","2024-03-20T09:14:46Z","2013-06-16T22:30:48Z"
"*localtunnel/server*",".{0,1000}localtunnel\/server.{0,1000}","greyware_tool_keyword","localtunnels","server for localtunnel.me - localtunnel exposes your localhost to the world for easy testing and sharing","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/localtunnel/server","1","1","N/A","N/A","8","10","3139","1022","2024-03-20T09:14:46Z","2013-06-16T22:30:48Z"
"*localtunnel/server.git*",".{0,1000}localtunnel\/server\.git.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/NoahShen/gotunnelme","1","1","N/A","N/A","10","10","170","46","2018-01-06T04:41:15Z","2013-10-18T02:46:51Z"
"*localtunnel-server:latest*",".{0,1000}localtunnel\-server\:latest.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/NoahShen/gotunnelme","1","1","N/A","N/A","10","10","170","46","2018-01-06T04:41:15Z","2013-10-18T02:46:51Z"
"*localxpose/localxpose*",".{0,1000}localxpose\/localxpose.{0,1000}","greyware_tool_keyword","localxpose","LocalXpose is a reverse proxy that enables you to expose your localhost to the internet","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://localxpose.io/","1","1","N/A","N/A","10","1","N/A","N/A","N/A","N/A"
"*loclx-client.s3.amazonaws.com*",".{0,1000}loclx\-client\.s3\.amazonaws\.com.{0,1000}","greyware_tool_keyword","localxpose","LocalXpose is a reverse proxy that enables you to expose your localhost to the internet","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://localxpose.io/","1","1","N/A","N/A","10","1","N/A","N/A","N/A","N/A"
"*login.remotepc.com*",".{0,1000}login\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","network","10","10","N/A","N/A","N/A","N/A"
"*login.swi-dre.com*",".{0,1000}login\.swi\-dre\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*login.tailscale.com*",".{0,1000}login\.tailscale\.com.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*LogMeInRescueTechnicianConsoleApp.msi*",".{0,1000}LogMeInRescueTechnicianConsoleApp\.msi.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*logs.logdna.com*",".{0,1000}logs\.logdna\.com.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","#logfile","N/A","10","10","N/A","N/A","N/A","N/A"
"*m2m.dataplicity.com*",".{0,1000}m2m\.dataplicity\.com.{0,1000}","greyware_tool_keyword","Dataplicity","enables connecting local systems to dataplicity cloud for remotely accessing them over the internet.","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/wildfoundry/dataplicity-agent","1","1","N/A","N/A","9","2","167","32","2024-06-10T20:17:43Z","2016-07-27T14:23:01Z"
"*Maldaptive.pd1*",".{0,1000}Maldaptive\.pd1.{0,1000}","greyware_tool_keyword","Invoke-Maldaptive","MaLDAPtive is a framework for LDAP SearchFilter parsing - obfuscation - deobfuscation and detection.","T1027","TA0005 - TA0007","N/A","N/A","Discovery","https://github.com/MaLDAPtive/Invoke-Maldaptive","1","1","N/A","N/A","7","3","261","24","2024-08-07T21:12:45Z","2024-08-07T20:43:52Z"
"*Maldaptive.psm1*",".{0,1000}Maldaptive\.psm1.{0,1000}","greyware_tool_keyword","Invoke-Maldaptive","MaLDAPtive is a framework for LDAP SearchFilter parsing - obfuscation - deobfuscation and detection.","T1027","TA0005 - TA0007","N/A","N/A","Discovery","https://github.com/MaLDAPtive/Invoke-Maldaptive","1","1","N/A","N/A","7","3","261","24","2024-08-07T21:12:45Z","2024-08-07T20:43:52Z"
"*MaLDAPtive/Invoke-Maldaptive*",".{0,1000}MaLDAPtive\/Invoke\-Maldaptive.{0,1000}","greyware_tool_keyword","Invoke-Maldaptive","MaLDAPtive is a framework for LDAP SearchFilter parsing - obfuscation - deobfuscation and detection.","T1027","TA0005 - TA0007","N/A","N/A","Discovery","https://github.com/MaLDAPtive/Invoke-Maldaptive","1","1","N/A","N/A","7","3","261","24","2024-08-07T21:12:45Z","2024-08-07T20:43:52Z"
"*managedsupport.kaseya.net*",".{0,1000}managedsupport\.kaseya\.net.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*mantvydasb/RedTeaming-Tactics-and-Techniques*",".{0,1000}mantvydasb\/RedTeaming\-Tactics\-and\-Techniques.{0,1000}","greyware_tool_keyword","ired.team","Red Teaming Tactics and Techniques","T1593.003","TA0043","N/A","N/A","Reconnaissance","https://github.com/mantvydasb/RedTeaming-Tactics-and-Techniques","1","1","N/A","N/A","7","10","4173","1068","2024-08-22T07:17:31Z","2019-03-02T13:33:33Z"
"*matiboy/SirTunnel*",".{0,1000}matiboy\/SirTunnel.{0,1000}","greyware_tool_keyword","SirTunnel","SirTunnel enables you to securely expose a webserver running on your computer to a public URL using HTTPS.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/anderspitman/SirTunnel","1","1","N/A","N/A","10","10","1404","119","2024-03-24T20:15:50Z","2020-09-23T00:15:26Z"
"*Mazars-Tech/AD_Miner*",".{0,1000}Mazars\-Tech\/AD_Miner.{0,1000}","greyware_tool_keyword","AD_Miner","AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security weaknesses","T1482 - T1069 - T1087","TA0007 ","N/A","EMBER BEAR","Discovery","https://github.com/Mazars-Tech/AD_Miner","1","1","N/A","N/A","6","10","1246","127","2025-02-28T09:22:28Z","2023-09-26T12:36:59Z"
"*mdmsupport.comodo.com*",".{0,1000}mdmsupport\.comodo\.com.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*mediator.goodsync.com*",".{0,1000}mediator\.goodsync\.com.{0,1000}","greyware_tool_keyword","Goodsync","GoodSync is a backup and file synchronization program abused by attacker for data exfiltration","T1567.002 - T1020 - T1039","TA0010 ","N/A","N/A","Data Exfiltration","https://www.goodsync.com/","1","1","#filehostingservice","N/A","9","10","N/A","N/A","N/A","N/A"
"*megasync-CentOS_*.x86_64.rpm*",".{0,1000}megasync\-CentOS_.{0,1000}\.x86_64\.rpm.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*megasync-CentOS_*.x86_64.rpm*",".{0,1000}megasync\-CentOS_.{0,1000}\.x86_64\.rpm.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*megasync-Debian_*_amd64.deb*",".{0,1000}megasync\-Debian_.{0,1000}_amd64\.deb.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*megasync-Fedora_*.x86_64.rpm*",".{0,1000}megasync\-Fedora_.{0,1000}\.x86_64\.rpm.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*megasync-openSUSE_Leap_*.x86_64.rpm*",".{0,1000}megasync\-openSUSE_Leap_.{0,1000}\.x86_64\.rpm.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*megasync-Raspbian_*_armhf.deb*",".{0,1000}megasync\-Raspbian_.{0,1000}_armhf\.deb.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*MEGAsyncSetupArm64.dmg*",".{0,1000}MEGAsyncSetupArm64\.dmg.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*megasync-x86_64.pkg*",".{0,1000}megasync\-x86_64\.pkg.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*megasync-xUbuntu_*_amd64.deb*",".{0,1000}megasync\-xUbuntu_.{0,1000}_amd64\.deb.{0,1000}","greyware_tool_keyword","MEGAsync","synchronize or backup your computers to MEGA","T1567.002 - T1537 - T1020 - T1030","TA0010 - TA0040","N/A","Akira - Phobos - BlackCat - Karakurt - Scattered Spider* - LockBit - BianLian - Hive - Trigona - Quantum - INC Ransom - EvilCorp* - Avaddon - EMBER BEAR","Data Exfiltration","https://mega.io/en/desktop","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*meshagent.exe*",".{0,1000}meshagent\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent.js*",".{0,1000}meshagent\.js.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshAgent.mpkg*",".{0,1000}MeshAgent\.mpkg.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent.pid*",".{0,1000}meshagent\.pid.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent.service*",".{0,1000}meshagent\.service.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent.zip*",".{0,1000}meshagent\.zip.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_aarch64*",".{0,1000}meshagent_aarch64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_aarch64-cortex-a53*",".{0,1000}meshagent_aarch64\-cortex\-a53.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_alpine-x86-64*",".{0,1000}meshagent_alpine\-x86\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_android.apk*",".{0,1000}meshagent_android\.apk.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_arm*",".{0,1000}meshagent_arm.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_arm64*",".{0,1000}meshagent_arm64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_armhf*",".{0,1000}meshagent_armhf.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_freebsd_x86-64*",".{0,1000}meshagent_freebsd_x86\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_mips*",".{0,1000}meshagent_mips.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_mips24kc*",".{0,1000}meshagent_mips24kc.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_mipsel24kc*",".{0,1000}meshagent_mipsel24kc.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_openbsd_x86-64*",".{0,1000}meshagent_openbsd_x86\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_openwrt_x86_64*",".{0,1000}meshagent_openwrt_x86_64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_osx64.msh*",".{0,1000}meshagent_osx64\.msh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_osx64_LaunchDaemon*",".{0,1000}meshagent_osx64_LaunchDaemon.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_osx-arm-64*",".{0,1000}meshagent_osx\-arm\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_osx-universal-64*",".{0,1000}meshagent_osx\-universal\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_osx-x86-32*",".{0,1000}meshagent_osx\-x86\-32.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_osx-x86-64*",".{0,1000}meshagent_osx\-x86\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_pogo*",".{0,1000}meshagent_pogo.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_poky*",".{0,1000}meshagent_poky.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_poky64*",".{0,1000}meshagent_poky64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent_x86-64*",".{0,1000}meshagent_x86\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent32.exe*",".{0,1000}meshagent32\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagent64.exe*",".{0,1000}meshagent64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshAgent-Android-x86*",".{0,1000}MeshAgent\-Android\-x86.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshagentarm64.exe*",".{0,1000}meshagentarm64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshAgent-ChromeOS*",".{0,1000}MeshAgent\-ChromeOS.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshAgent-Linux-ARM-PlugPC*",".{0,1000}MeshAgent\-Linux\-ARM\-PlugPC.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","#linux","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshAgent-Linux-XEN-x86-32*",".{0,1000}MeshAgent\-Linux\-XEN\-x86\-32.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","#linux","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshAgent-NodeJS*",".{0,1000}MeshAgent\-NodeJS.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshAgentOSXPackager.zip*",".{0,1000}MeshAgentOSXPackager\.zip.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshAgent-WinMinCore-Console-x86-32.exe*",".{0,1000}MeshAgent\-WinMinCore\-Console\-x86\-32\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshAgent-WinMinCore-Service-x86-64.exe*",".{0,1000}MeshAgent\-WinMinCore\-Service\-x86\-64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshcentral.exe*",".{0,1000}meshcentral\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshCentralAssistant.exe*",".{0,1000}MeshCentralAssistant\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshCentralInstaller.exe*",".{0,1000}MeshCentralInstaller\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshcentralinstaller.exe*",".{0,1000}meshcentralinstaller\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshCentralRouter.exe*",".{0,1000}MeshCentralRouter\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshCentralServer.njsproj*",".{0,1000}MeshCentralServer\.njsproj.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshCmd64.exe*",".{0,1000}MeshCmd64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshCmd-signed.exe*",".{0,1000}MeshCmd\-signed\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshConsole64.exe*",".{0,1000}MeshConsole64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshConsoleARM64.exe*",".{0,1000}MeshConsoleARM64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshinstall-initd.sh*",".{0,1000}meshinstall\-initd\.sh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*meshinstall-linux.sh*",".{0,1000}meshinstall\-linux\.sh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","#linux","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MeshService.exe*",".{0,1000}MeshService\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*MITMServerHijacking/MITMPluginLocalList*",".{0,1000}MITMServerHijacking\/MITMPluginLocalList.{0,1000}","greyware_tool_keyword","yakit","security platform with fuzzers - webshell and MITM (chinese burp)","T1557 - T1557.003 - T1569.002","TA0001 - TA0040","N/A","N/A","Sniffing & Spoofing","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","7","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*mkj/dropbear*",".{0,1000}mkj\/dropbear.{0,1000}","greyware_tool_keyword","dropbear","A smallish SSH server and client","T1021.004 - T1570","TA0003","N/A","COZY BEAR","Persistence","https://github.com/mkj/dropbear","1","1","N/A","N/A","8","10","1814","407","2025-02-22T14:42:34Z","2013-03-19T11:15:36Z"
"*mmatczuk/go-http-tunnel.git*",".{0,1000}mmatczuk\/go\-http\-tunnel\.git.{0,1000}","greyware_tool_keyword","go-http-tunnel","Fast and secure tunnels over HTTP/2","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/mmatczuk/go-http-tunnel","1","1","N/A","N/A","10","10","3251","310","2024-04-19T12:25:30Z","2016-10-12T12:59:38Z"
"*Mozilla/5.0 (compatible; ngrok)*",".{0,1000}Mozilla\/5\.0\s\(compatible\;\sngrok\).{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","#useragent","N/A","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*msi-installs.swi-rc.com/*",".{0,1000}msi\-installs\.swi\-rc\.com\/.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*net-proxy/sshuttle*",".{0,1000}net\-proxy\/sshuttle.{0,1000}","greyware_tool_keyword","sshuttle","Transparent proxy server that works as a poor man's VPN. Forwards over ssh","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/sshuttle/sshuttle","1","1","#linux","N/A","10","10","12039","752","2025-03-02T09:39:56Z","2014-09-15T04:51:13Z"
"*netscan_portable.zip*",".{0,1000}netscan_portable\.zip.{0,1000}","greyware_tool_keyword","softperfect networkscanner","SoftPerfect Network Scanner can ping computers scan ports discover shared folders and retrieve practically any information about network devices via WMI SNMP HTTP SSH and PowerShell","T1046 - T1065 - T1135 ","TA0007 ","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - LockBit - BianLian - Conti - BlackCat - Dagon Locker - Nokoyawa - Trigona - Hive - BlackByte - RansomHub - Cactus - Fog - Medusa - Avaddon - Cobalt Group - FIN7 - Anunak","Discovery","https://www.softperfect.com/products/networkscanner/","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*netshrun.dll*",".{0,1000}netshrun\.dll.{0,1000}","greyware_tool_keyword","NetshRun","Netsh.exe relies on extensions taken from Registry which means it may be used as a persistence and you go one step further extending netsh with a DLL allowing you to do whatever you want","T1546.008 - T1112 - T1037 - T1055 - T1218.001","TA0003 - TA0002 - TA0008","N/A","N/A","Exploitation tool","https://github.com/gtworek/PSBits/blob/master/NetShRun","1","1","N/A","N/A","N/A","10","3304","542","2025-01-21T05:52:54Z","2019-06-29T13:22:36Z"
"*NetSupport Manager (1).msi*",".{0,1000}NetSupport\sManager\s\(1\)\.msi.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*NetSupport Manager.msi*",".{0,1000}NetSupport\sManager\.msi.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*NetSupport%20Manager.msi*",".{0,1000}NetSupport\%20Manager\.msi.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*netwrix/pingcastle*",".{0,1000}netwrix\/pingcastle.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://github.com/netwrix/pingcastle","1","1","N/A","N/A","10","10","2452","303","2025-02-28T10:16:24Z","2018-08-31T17:42:48Z"
"*ngrokd.ngrok.com*",".{0,1000}ngrokd\.ngrok\.com.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","N/A","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*NoahShen/gotunnelme*",".{0,1000}NoahShen\/gotunnelme.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/NoahShen/gotunnelme","1","1","N/A","N/A","10","10","170","46","2018-01-06T04:41:15Z","2013-10-18T02:46:51Z"
"*notifications.*.swi-rc.com*",".{0,1000}notifications\..{0,1000}\.swi\-rc\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*nse_install.py*",".{0,1000}nse_install\.py.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*nse-insall-0.0.1*",".{0,1000}nse\-insall\-0\.0\.1.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*ntnj/tunwg*",".{0,1000}ntnj\/tunwg.{0,1000}","greyware_tool_keyword","tunwg","End to end encrypted secure tunnel to local servers","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ntnj/tunwg","1","1","N/A","N/A","10","10","233","9","2024-09-18T15:03:45Z","2023-01-16T17:51:13Z"
"*NullSessionScanner.*",".{0,1000}NullSessionScanner\..{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner and Earth Lusca Operations Tools and commands","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://github.com/vletoux/pingcastle","1","1","N/A","N/A","10","10","2452","303","2025-02-28T10:16:24Z","2018-08-31T17:42:48Z"
"*objects.githubusercontent.com/github-production-release-asset-*",".{0,1000}objects\.githubusercontent\.com\/github\-production\-release\-asset\-.{0,1000}","greyware_tool_keyword","github","Github executables download initiated - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*OCSAF/freevulnsearch*",".{0,1000}OCSAF\/freevulnsearch.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*online.level.io*",".{0,1000}online\.level\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*openziti/zrok*",".{0,1000}openziti\/zrok.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*oshi.at/onion*",".{0,1000}oshi\.at\/onion.{0,1000}","greyware_tool_keyword","OshiUpload","Ephemeral file sharing engine","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Black Basta","Data Exfiltration","https://github.com/somenonymous/OshiUpload","1","1","#filehostingservice #P2P","N/A","10","2","188","26","2022-10-01T04:08:29Z","2019-05-11T02:08:51Z"
"*oshiatwowvdbshka.onion*",".{0,1000}oshiatwowvdbshka\.onion.{0,1000}","greyware_tool_keyword","OshiUpload","Ephemeral file sharing engine","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Black Basta","Data Exfiltration","https://github.com/somenonymous/OshiUpload","1","1","#filehostingservice #P2P","N/A","10","2","188","26","2022-10-01T04:08:29Z","2019-05-11T02:08:51Z"
"*OshiUpload-master.zip*",".{0,1000}OshiUpload\-master\.zip.{0,1000}","greyware_tool_keyword","OshiUpload","Ephemeral file sharing engine","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Black Basta","Data Exfiltration","https://github.com/somenonymous/OshiUpload","1","1","#filehostingservice #P2P","N/A","10","2","188","26","2022-10-01T04:08:29Z","2019-05-11T02:08:51Z"
"*packages/hypertunnel/*",".{0,1000}packages\/hypertunnel\/.{0,1000}","greyware_tool_keyword","hypertunnel","Expose any local TCP/IP service on the internet","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/berstend/hypertunnel","1","1","N/A","N/A","10","10","246","47","2022-12-08T19:13:24Z","2018-06-11T05:29:58Z"
"*packages/hypertunnel-server*",".{0,1000}packages\/hypertunnel\-server.{0,1000}","greyware_tool_keyword","hypertunnel","Expose any local TCP/IP service on the internet","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/berstend/hypertunnel","1","1","N/A","N/A","10","10","246","47","2022-12-08T19:13:24Z","2018-06-11T05:29:58Z"
"*packages/hypertunnel-tcp-relay*",".{0,1000}packages\/hypertunnel\-tcp\-relay.{0,1000}","greyware_tool_keyword","hypertunnel","Expose any local TCP/IP service on the internet","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/berstend/hypertunnel","1","1","N/A","N/A","10","10","246","47","2022-12-08T19:13:24Z","2018-06-11T05:29:58Z"
"*PAExec-master.zip*",".{0,1000}PAExec\-master\.zip.{0,1000}","greyware_tool_keyword","PAExec","PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program","T1047 - T1105 - T1204","TA0003 - TA0008 - TA0040","N/A","N/A","Lateral Movement","https://github.com/poweradminllc/PAExec","1","1","N/A","N/A","10","6","551","178","2025-02-21T15:14:44Z","2013-11-13T04:05:27Z"
"*pagekite/PyPagekite*",".{0,1000}pagekite\/PyPagekite.{0,1000}","greyware_tool_keyword","PyPagekite","This is pagekite.py a fast and reliable tool to make localhost servers visible to the public Internet.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pagekite/PyPagekite","1","1","N/A","N/A","10","10","728","123","2024-08-13T23:59:19Z","2010-10-23T00:03:37Z"
"*pahaz/sshtunnel*",".{0,1000}pahaz\/sshtunnel.{0,1000}","greyware_tool_keyword","sshtunnel","SSH tunnels to remote server","T1572 - T1219","TA0005 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://github.com/pahaz/sshtunnel","1","1","N/A","N/A","10","10","1246","185","2024-03-10T15:20:42Z","2014-06-11T21:14:05Z"
"*par-k8s.syncthing.net*",".{0,1000}par\-k8s\.syncthing\.net.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*par-k8s-v4.syncthing.net*",".{0,1000}par\-k8s\-v4\.syncthing\.net.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*paste.ee/d/*",".{0,1000}paste\.ee\/d\/.{0,1000}","greyware_tool_keyword","paste.ee","fetching data from paste.ee","T1041","TA0009","N/A","N/A","Collection","paste.ee","1","1","#PastebinLike","N/A","8","10","N/A","N/A","N/A","N/A"
"*paste.ee/paste*",".{0,1000}paste\.ee\/paste.{0,1000}","greyware_tool_keyword","paste.ee","posting data on paste.ee","T1041","TA0010","N/A","N/A","Data Exfiltration","paste.ee","1","1","#PastebinLike","N/A","10","10","N/A","N/A","N/A","N/A"
"*pastebin.com*/raw/* ",".{0,1000}pastebin\.com.{0,1000}\/raw\/.{0,1000}\s","greyware_tool_keyword","pastebin","pastebin raw access content - abused by malwares to retrieve payloads","T1119","TA0009","Redline Stealer","Black Basta","Collection","pastebin.com","1","1","#PastebinLike","greyware tool - risks of False positive !","8","10","N/A","N/A","N/A","N/A"
"*pastebin.com*/rw/*",".{0,1000}pastebin\.com.{0,1000}\/rw\/.{0,1000}","greyware_tool_keyword","pastebin","pastebin raw access content - abused by malwares to retrieve payloads","T1119","TA0009","Redline Stealer","Black Basta","Collection","pastebin.com","1","1","#PastebinLike","greyware tool - risks of False positive !","8","10","N/A","N/A","N/A","N/A"
"*pastebin.com*api/api_post.php*",".{0,1000}pastebin\.com.{0,1000}api\/api_post\.php.{0,1000}","greyware_tool_keyword","pastebin","pastebin POST url - abused by malwares to exfiltrate informations","T1102 - T1048 - T1094 - T1608.001","TA0011","N/A","Black Basta","Data Exfiltration","pastebin.com","1","1","#PastebinLike","greyware tool - risks of False positive !","8","10","N/A","N/A","N/A","N/A"
"*pastebin.pl/cdn-cgi/challenge-platform/*",".{0,1000}pastebin\.pl\/cdn\-cgi\/challenge\-platform\/.{0,1000}","greyware_tool_keyword","pastebin.pl","sending data to a pastebin","T1567.002","TA0010","N/A","N/A","Data Exfiltration","https://pastebin.pl/","1","1","#PastebinLike","N/A","8","8","N/A","N/A","N/A","N/A"
"*pastebin.pl/view/raw/*",".{0,1000}pastebin\.pl\/view\/raw\/.{0,1000}","greyware_tool_keyword","pastebin.pl","accessing paste raw content","T1119","TA0009","N/A","N/A","Collection","https://pastebin.pl/","1","1","#PastebinLike","N/A","8","8","N/A","N/A","N/A","N/A"
"*payment.cyberghostvpn.com*",".{0,1000}payment\.cyberghostvpn\.com.{0,1000}","greyware_tool_keyword","CyberGhost VPN","External VPN usage within coporate network","T1567 - T1090","TA0003 - TA0005 - TA0009 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://www.cyberghostvpn.com/","1","1","#VPN","N/A","9","8","N/A","N/A","N/A","N/A"
"*PCHunter32.exe*",".{0,1000}PCHunter32\.exe.{0,1000}","greyware_tool_keyword","PCHunter","PCHunter is a toolkit offering deep access to kernel setting - processes - network  and startup configurations. It is designed to detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","LockBit - Conti - 8BASE - TargetCompany - Hive - Qilin","Defense Evasion","https://www.majorgeeks.com/files/details/pc_hunter.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*PCHunter64.exe*",".{0,1000}PCHunter64\.exe.{0,1000}","greyware_tool_keyword","PCHunter","PCHunter is a toolkit offering deep access to kernel setting - processes - network  and startup configurations. It is designed to detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","LockBit - Conti - 8BASE - TargetCompany - Hive - Qilin","Defense Evasion","https://www.majorgeeks.com/files/details/pc_hunter.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*PCMonitorCfg.dll*",".{0,1000}PCMonitorCfg\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorClient.dll*",".{0,1000}PCMonitorClient\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorEng.dll*",".{0,1000}PCMonitorEng\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorManager.exe*",".{0,1000}PCMonitorManager\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorManager.exe*",".{0,1000}PCMonitorManager\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorSrv.exe*",".{0,1000}PCMonitorSrv\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorSrv.exe*",".{0,1000}PCMonitorSrv\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorSrv.InstallState*",".{0,1000}PCMonitorSrv\.InstallState.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorTypes.dll*",".{0,1000}PCMonitorTypes\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*pcmrdp-client.dll*",".{0,1000}pcmrdp\-client\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*pcunlocker_ent_trial.zip*",".{0,1000}pcunlocker_ent_trial\.zip.{0,1000}","greyware_tool_keyword","pcunlocker","Reset and unlock forgotten Windows login password","T1078","TA0005 - TA0006 - TA0009","N/A","N/A","Credential Access","https://www.pcunlocker.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*pgrok/pgrok*",".{0,1000}pgrok\/pgrok.{0,1000}","greyware_tool_keyword","pgrok","Poor man's ngrok - a multi-tenant HTTP/TCP reverse tunnel solution through SSH remote port forwarding","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/pgrok/pgrok","1","1","N/A","N/A","10","10","3263","112","2025-03-01T08:52:06Z","2023-03-08T12:43:55Z"
"*phillips321/adaudit*",".{0,1000}phillips321\/adaudit.{0,1000}","greyware_tool_keyword","adaudit","Powershell script to do domain auditing automation","T1482 - T1087","TA0007","N/A","N/A","Discovery","https://github.com/phillips321/adaudit","1","1","N/A","N/A","8","4","386","104","2024-11-15T10:37:29Z","2018-04-20T11:29:06Z"
"*PhoenixMiner.exe*",".{0,1000}PhoenixMiner\.exe.{0,1000}","greyware_tool_keyword","phoenix miner","Phoenix Miner is a popular. efficient. fast. and cost-effective Ethereum miner with support for both AMD and Nvidia GPUs. It's intended to be used for legitimate cryptocurrency mining purposes.Attackers can secretly install Phoenix Miner on unsuspecting users' computers to mine cryptocurrency for themselves. This is often done by bundling the miner with other software or hiding it within malicious attachments or downloads. The computer then slow down due to the high CPU and GPU usage","T1059.001 - T1057 - T1027 - T1105 - T1064 - T1053.005 - T1089","TA0002 - TA0005 - TA0011 - TA0040 - TA0003","N/A","N/A","Phishing","N/A","1","1","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
"*pingcastle*",".{0,1000}pingcastle.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://www.pingcastle.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PingCastle.exe*",".{0,1000}PingCastle\.exe.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner and Earth Lusca Operations Tools and commands","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf https://github.com/vletoux/pingcastle","1","1","N/A","N/A","10","","N/A","","",""
"*pingcastlecloud.exe*",".{0,1000}pingcastlecloud\.exe.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://github.com/netwrix/pingcastle","1","1","N/A","N/A","10","10","2452","303","2025-02-28T10:16:24Z","2018-08-31T17:42:48Z"
"*PingCastleReporting.exe*",".{0,1000}PingCastleReporting\.exe.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://github.com/netwrix/pingcastle","1","1","N/A","N/A","10","10","2452","303","2025-02-28T10:16:24Z","2018-08-31T17:42:48Z"
"*pkgs.tailscale.com/*/*",".{0,1000}pkgs\.tailscale\.com\/.{0,1000}\/.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*PortableApps.com/EraserPortable*",".{0,1000}PortableApps\.com\/EraserPortable.{0,1000}","greyware_tool_keyword","eraser","It completely removes sensitive data from your hard drive by overwriting it several times with carefully selected patterns - abusedby attackers for anti forensic","T1070 - T1488 - T1561","TA0005","N/A","BlackSuit - Royal","Defense Evasion","https://sourceforge.net/projects/eraser","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*portr_admin.db*",".{0,1000}portr_admin\.db.{0,1000}","greyware_tool_keyword","Portr","Portr is a tunnel solution that allows you to expose local http, tcp or websocket connections to the public internet","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/amalshaji/portr","1","1","N/A","N/A","10","10","2384","71","2025-03-02T14:19:09Z","2023-11-21T11:14:01Z"
"*poweradmin.com/PAExec*",".{0,1000}poweradmin\.com\/PAExec.{0,1000}","greyware_tool_keyword","PAExec","PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program","T1047 - T1105 - T1204","TA0003 - TA0008 - TA0040","N/A","N/A","Lateral Movement","https://github.com/poweradminllc/PAExec","1","1","N/A","N/A","10","6","551","178","2025-02-21T15:14:44Z","2013-11-13T04:05:27Z"
"*poweradminllc/PAExec*",".{0,1000}poweradminllc\/PAExec.{0,1000}","greyware_tool_keyword","PAExec","PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program","T1047 - T1105 - T1204","TA0003 - TA0008 - TA0040","N/A","N/A","Lateral Movement","https://github.com/poweradminllc/PAExec","1","1","N/A","N/A","10","6","551","178","2025-02-21T15:14:44Z","2013-11-13T04:05:27Z"
"*processhacker-*-sdk.zip*",".{0,1000}processhacker\-.{0,1000}\-sdk\.zip.{0,1000}","greyware_tool_keyword","processhacker","Interactions with a objects present in windows such as threads stack - handles - gpu - services ? can be used by attackers to dump process - create services  and process injection","T1055.001 - T1055.012 - T1003.001 - T1056.005","TA0005 - TA0003 - TA0040 - TA0006 - TA0009","N/A","N/A","Persistence","https://processhacker.sourceforge.io/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*processhacker-*-setup.exe*",".{0,1000}processhacker\-.{0,1000}\-setup\.exe.{0,1000}","greyware_tool_keyword","processhacker","Interactions with a objects present in windows such as threads stack - handles - gpu - services ? can be used by attackers to dump process - create services  and process injection","T1055.001 - T1055.012 - T1003.001 - T1056.005","TA0005 - TA0003 - TA0040 - TA0006 - TA0009","N/A","N/A","Persistence","https://processhacker.sourceforge.io/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*processhacker-*-src.zip*",".{0,1000}processhacker\-.{0,1000}\-src\.zip.{0,1000}","greyware_tool_keyword","processhacker","Interactions with a objects present in windows such as threads stack - handles - gpu - services ? can be used by attackers to dump process - create services  and process injection","T1055.001 - T1055.012 - T1003.001 - T1056.005","TA0005 - TA0003 - TA0040 - TA0006 - TA0009","N/A","N/A","Persistence","https://processhacker.sourceforge.io/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*ProcessHacker.exe*",".{0,1000}ProcessHacker\.exe.{0,1000}","greyware_tool_keyword","processhacker","Interactions with a objects present in windows such as threads stack - handles - gpu - services ? can be used by attackers to dump process - create services  and process injection","T1055.001 - T1055.012 - T1003.001 - T1056.005","TA0005 - TA0003 - TA0040 - TA0006 - TA0009","N/A","N/A","Persistence","https://processhacker.sourceforge.io/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*ProcessHacker.sln*",".{0,1000}ProcessHacker\.sln.{0,1000}","greyware_tool_keyword","processhacker","Interactions with a objects present in windows such as threads stack - handles - gpu - services ? can be used by attackers to dump process - create services  and process injection","T1055.001 - T1055.012 - T1003.001 - T1056.005","TA0005 - TA0003 - TA0040 - TA0006 - TA0009","N/A","N/A","Persistence","https://processhacker.sourceforge.io/","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*prod.surfshark.com*",".{0,1000}prod\.surfshark\.com.{0,1000}","greyware_tool_keyword","surfshark VPN","usage of surfsharkVPN client","T1090 - T1573","TA0005 - TA010","N/A","N/A","Defense Evasion","","1","1","N/A","N/A","7","8","N/A","N/A","N/A","N/A"
"*produkey.zip*",".{0,1000}produkey\.zip.{0,1000}","greyware_tool_keyword","produkey","ProduKey is a small utility that displays the ProductID and the CD-Key of Microsoft Office (Microsoft Office 2003. Microsoft Office 2007). Windows (Including Windows 8/7/Vista). Exchange Server. and SQL Server installed on your computer. You can view this information for your current running operating system. or for another operating system/computer - by using command-line options. This utility can be useful if you lost the product key of your Windows/Office. and you want to reinstall it on your computer.","T1003.001 - T1003.002 - T1012 - T1057 - T1518","TA0006 - TA0007 - TA0009","N/A","Evilnum","Credential Access","https://www.nirsoft.net/utils/product_cd_key_viewer.html","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*produkey_setup.exe*",".{0,1000}produkey_setup\.exe.{0,1000}","greyware_tool_keyword","produkey","ProduKey is a small utility that displays the ProductID and the CD-Key of Microsoft Office (Microsoft Office 2003. Microsoft Office 2007). Windows (Including Windows 8/7/Vista). Exchange Server. and SQL Server installed on your computer. You can view this information for your current running operating system. or for another operating system/computer - by using command-line options. This utility can be useful if you lost the product key of your Windows/Office. and you want to reinstall it on your computer.","T1003.001 - T1003.002 - T1012 - T1057 - T1518","TA0006 - TA0007 - TA0009","N/A","Evilnum","Credential Access","https://www.nirsoft.net/utils/product_cd_key_viewer.html","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*produkey-x64.zip*",".{0,1000}produkey\-x64\.zip.{0,1000}","greyware_tool_keyword","produkey","ProduKey is a small utility that displays the ProductID and the CD-Key of Microsoft Office (Microsoft Office 2003. Microsoft Office 2007). Windows (Including Windows 8/7/Vista). Exchange Server. and SQL Server installed on your computer. You can view this information for your current running operating system. or for another operating system/computer - by using command-line options. This utility can be useful if you lost the product key of your Windows/Office. and you want to reinstall it on your computer.","T1003.001 - T1003.002 - T1012 - T1057 - T1518","TA0006 - TA0007 - TA0009","N/A","Evilnum","Credential Access","https://www.nirsoft.net/utils/product_cd_key_viewer.html","1","1","N/A","N/A","6","10","N/A","N/A","N/A","N/A"
"*projectdiscovery/interactsh*",".{0,1000}projectdiscovery\/interactsh.{0,1000}","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C12","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*protocol-v2.argotunnel.com*",".{0,1000}protocol\-v2\.argotunnel\.com.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","N/A","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*PSBits*NetShRun*",".{0,1000}PSBits.{0,1000}NetShRun.{0,1000}","greyware_tool_keyword","NetshRun","Netsh.exe relies on extensions taken from Registry which means it may be used as a persistence and you go one step further extending netsh with a DLL allowing you to do whatever you want","T1546.008 - T1112 - T1037 - T1055 - T1218.001","TA0003 - TA0002 - TA0008","N/A","N/A","Exploitation tool","https://github.com/gtworek/PSBits/blob/master/NetShRun","1","1","N/A","N/A","N/A","10","3304","542","2025-01-21T05:52:54Z","2019-06-29T13:22:36Z"
"*psc4re/NSE-scripts*",".{0,1000}psc4re\/NSE\-scripts.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*PsLoggedon.exe*",".{0,1000}PsLoggedon\.exe.{0,1000}","greyware_tool_keyword","psloggedon","PsLoggedOn is an applet that displays both the locally logged on users and users logged on via resources for either the local computer. or a remote one","T1003 - T1049 - T1057 - T1082 - T1087 - T1518","TA0001 - TA0002 - TA0007 - TA0011","N/A","N/A","Reconnaissance","https://learn.microsoft.com/en-us/sysinternals/downloads/psloggedon","1","1","N/A","greyware tool - risks of False positive !","8","10","N/A","N/A","N/A","N/A"
"*PsLoggedon64.exe*",".{0,1000}PsLoggedon64\.exe.{0,1000}","greyware_tool_keyword","psloggedon","PsLoggedOn is an applet that displays both the locally logged on users and users logged on via resources for either the local computer. or a remote one","T1003 - T1049 - T1057 - T1082 - T1087 - T1518","TA0001 - TA0002 - TA0007 - TA0011","N/A","N/A","Reconnaissance","https://learn.microsoft.com/en-us/sysinternals/downloads/psloggedon","1","1","N/A","greyware tool - risks of False positive !","8","10","N/A","N/A","N/A","N/A"
"*pufferffish/wireproxy*",".{0,1000}pufferffish\/wireproxy.{0,1000}","greyware_tool_keyword","wireproxy","Wireguard client that exposes itself as a socks5 proxy","T1572 - T1090 - T1071.004","TA0011 - TA0005","N/A","N/A","C2","https://github.com/pufferffish/wireproxy","1","1","N/A","N/A","10","10","4794","293","2025-02-19T17:22:57Z","2022-03-11T12:32:10Z"
"*pwyrc-clip.exe*",".{0,1000}pwyrc\-clip\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*py2exe-*.tar.gz*",".{0,1000}py2exe\-.{0,1000}\.tar\.gz.{0,1000}","greyware_tool_keyword","py2exe","py2exe allows you to convert Python scripts into standalone executable files for Windows othen used by attacker","T1027.002 - T1045 - T1059.001 - T1587.001","TA0005 - TA0042","Operation Wocao","N/A","Resource Development","https://github.com/py2exe/py2exe","1","1","N/A","greyware_tools high risks of false positives","N/A","10","914","102","2024-11-12T19:44:34Z","2019-03-11T13:16:35Z"
"*py2exe-*.whl*",".{0,1000}py2exe\-.{0,1000}\.whl.{0,1000}","greyware_tool_keyword","py2exe","py2exe allows you to convert Python scripts into standalone executable files for Windows othen used by attacker","T1027.002 - T1045 - T1059.001 - T1587.001","TA0005 - TA0042","Operation Wocao","N/A","Resource Development","https://github.com/py2exe/py2exe","1","1","N/A","greyware_tools high risks of false positives","N/A","10","914","102","2024-11-12T19:44:34Z","2019-03-11T13:16:35Z"
"*py2exe.build_exe*",".{0,1000}py2exe\.build_exe.{0,1000}","greyware_tool_keyword","py2exe","py2exe allows you to convert Python scripts into standalone executable files for Windows othen used by attacker","T1027.002 - T1045 - T1059.001 - T1587.001","TA0005 - TA0042","Operation Wocao","N/A","Resource Development","https://github.com/py2exe/py2exe","1","1","N/A","greyware_tools high risks of false positives","N/A","10","914","102","2024-11-12T19:44:34Z","2019-03-11T13:16:35Z"
"*py2exe.freeze*",".{0,1000}py2exe\.freeze.{0,1000}","greyware_tool_keyword","py2exe","py2exe allows you to convert Python scripts into standalone executable files for Windows othen used by attacker","T1027.002 - T1045 - T1059.001 - T1587.001","TA0005 - TA0042","Operation Wocao","N/A","Resource Development","https://github.com/py2exe/py2exe","1","1","N/A","greyware_tools high risks of false positives","N/A","10","914","102","2024-11-12T19:44:34Z","2019-03-11T13:16:35Z"
"*py2exe.git*",".{0,1000}py2exe\.git.{0,1000}","greyware_tool_keyword","py2exe","py2exe allows you to convert Python scripts into standalone executable files for Windows othen used by attacker","T1027.002 - T1045 - T1059.001 - T1587.001","TA0005 - TA0042","Operation Wocao","N/A","Resource Development","https://github.com/py2exe/py2exe","1","1","N/A","greyware_tools high risks of false positives","N/A","10","914","102","2024-11-12T19:44:34Z","2019-03-11T13:16:35Z"
"*py2exe_setuptools.py*",".{0,1000}py2exe_setuptools\.py.{0,1000}","greyware_tool_keyword","py2exe","py2exe allows you to convert Python scripts into standalone executable files for Windows othen used by attacker","T1027.002 - T1045 - T1059.001 - T1587.001","TA0005 - TA0042","Operation Wocao","N/A","Resource Development","https://github.com/py2exe/py2exe","1","1","N/A","greyware_tools high risks of false positives","N/A","10","914","102","2024-11-12T19:44:34Z","2019-03-11T13:16:35Z"
"*py2exe-master.zip*",".{0,1000}py2exe\-master\.zip.{0,1000}","greyware_tool_keyword","py2exe","py2exe allows you to convert Python scripts into standalone executable files for Windows othen used by attacker","T1027.002 - T1045 - T1059.001 - T1587.001","TA0005 - TA0042","Operation Wocao","N/A","Resource Development","https://github.com/py2exe/py2exe","1","1","N/A","greyware_tools high risks of false positives","N/A","10","914","102","2024-11-12T19:44:34Z","2019-03-11T13:16:35Z"
"*pyinstaller.exe*",".{0,1000}pyinstaller\.exe.{0,1000}","greyware_tool_keyword","pyinstaller","PyInstaller bundles a Python application and all its dependencies into a single package executable.","T1027.002 - T1045 - T1059.001 - T1587.001","TA0005 - TA0042","N/A","N/A","Resource Development","https://www.pyinstaller.org/","1","1","N/A","greyware_tools high risks of false positives","N/A","N/A","N/A","N/A","N/A","N/A"
"*pyinstaller-script.py*",".{0,1000}pyinstaller\-script\.py.{0,1000}","greyware_tool_keyword","pyinstaller","PyInstaller bundles a Python application and all its dependencies into a single package executable.","T1027.002 - T1045 - T1059.001 - T1587.001","TA0005 - TA0042","N/A","N/A","Resource Development","https://www.pyinstaller.org/","1","1","N/A","greyware_tools high risks of false positives","N/A","N/A","N/A","N/A","N/A","N/A"
"*pyjam.as/tunnel*",".{0,1000}pyjam\.as\/tunnel.{0,1000}","greyware_tool_keyword","tunnel.pyjam.as","SSL-terminated ephemeral HTTP tunnels to your local machine - no custom software required (thanks to wireguard)","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://gitlab.com/pyjam.as/tunnel","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*q3k/crowbar*",".{0,1000}q3k\/crowbar.{0,1000}","greyware_tool_keyword","crowbar","Tunnel TCP over a plain HTTP session","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","Dispossessor","C2","https://github.com/q3k/crowbar","1","1","N/A","N/A","10","10","476","41","2021-01-24T08:21:05Z","2015-02-03T18:40:00Z"
"*QNAME*.trycloudfare.com*",".{0,1000}QNAME.{0,1000}\.trycloudfare\.com.{0,1000}","greyware_tool_keyword","trycloudflare.com","The subdomain .trycloudflare.com is a temporary hostname provided by Cloudflare Tunnel - It allows users to expose local services to the internet without needing to configure port forwarding or a public IP - attackers frequently abuse it for malicious activities","T1071.001 - T1090 - T1583.003 - T1102","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","Phishing","https://www.forcepoint.com/blog/x-labs/asyncrat-python-trycloudflare-malware","1","1","#dnsquery","N/A","10","10","N/A","N/A","N/A","N/A"
"*Quasar.Client.*",".{0,1000}Quasar\.Client\..{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","9032","2528","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar.exe*",".{0,1000}Quasar\.exe.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","9032","2528","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar.sln*",".{0,1000}Quasar\.sln.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","9032","2528","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*quasar/Quasar*",".{0,1000}quasar\/Quasar.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","9032","2528","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar-master.zip*",".{0,1000}Quasar\-master\.zip.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","9032","2528","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*QuasarRAT*",".{0,1000}QuasarRAT.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","9032","2528","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*randomx.xmrig.com*",".{0,1000}randomx\.xmrig\.com.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*rapiz1/rathole*",".{0,1000}rapiz1\/rathole.{0,1000}","greyware_tool_keyword","rathole"," expose the service on the device behind the NAT to the Internet, via a server with a public IP.","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/rapiz1/rathole","1","1","N/A","N/A","10","10","10394","532","2024-07-06T20:09:48Z","2021-12-14T05:03:07Z"
"*raw.githubusercontent.com*.7z*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.7z.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.apk*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.apk.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.app*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.app.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.as*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.as.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.asc*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.asc.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.asp*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.asp.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.bash*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.bash.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","#linux","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.bat*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.bat.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.beacon*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.beacon.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.bin*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.bin.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.bpl*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.bpl.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.c",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.c","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.cer*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.cer.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.cmd*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.cmd.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.com*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.com.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.cpp*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.cpp.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.crt*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.crt.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.cs*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.cs.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.csh*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.csh.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.dat*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.dat.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.dll*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.dll.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.docm*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.docm.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.dos*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.dos.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.exe*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.go*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.go.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.gz*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.gz.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.hta*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.hta.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.iso*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.iso.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.jar*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.jar.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.js*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.js.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.lnk*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.lnk.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.log*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.log.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.mac*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.mac.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.mam*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.mam.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.msi*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.msp*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.msp.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.nexe*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.nexe.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.nim*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.nim.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.otm*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.otm.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.out*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.out.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.ova*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.ova.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.pem*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.pem.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.pfx*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.pfx.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.pl*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.pl.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.plx*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.plx.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.pm*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.pm.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.ppk*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.ppk.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.ps1*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.ps1.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.psm1*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.psm1.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.pub*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.pub.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.py*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.py.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.pyc*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.pyc.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.pyo*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.pyo.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.rar*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.rar.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.raw*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.raw.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.reg*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.reg.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.rgs*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.rgs.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.RGS*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.RGS.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.run*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.run.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.scpt*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.scpt.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.script*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.script.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.sct*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.sct.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.sh*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.sh.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.ssh*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.ssh.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.sys*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.sys.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.teamserver*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.teamserver.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.temp*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.temp.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.tgz*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.tgz.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.tmp*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.tmp.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.vb*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.vb.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.vbs*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.vbs.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.vbscript*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.vbscript.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.ws*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.ws.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.wsf*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.wsf.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.wsh*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.wsh.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.X86*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.X86.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.X86_64*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.X86_64.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.xlam*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.xlam.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.xlm*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.xlm.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.xlsm*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.xlsm.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*raw.githubusercontent.com*.zip*",".{0,1000}raw\.githubusercontent\.com.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","github","Github raw access content - abused by malwares to retrieve payloads","T1119","TA0009","N/A","N/A","Collection","https://github.com/","1","1","N/A","greyware tool - risks of False positive !","9","10","N/A","N/A","N/A","N/A"
"*rclone/rclone*",".{0,1000}rclone\/rclone.{0,1000}","greyware_tool_keyword","rclone","Rclone is a command line program for syncing files with cloud storage services - abused by a lot of ransomware groups","T1567.002 - T1560.001 - T1030 - T1048.002 - T1048.003 - T1567.002 - T1083","TA0010","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - Karakurt - AvosLocker - LockBit - BianLian - Hive - Daixin - Conti - Dagon Locker - Trigona - Quantum - Revil - 8BASE - INC Ransom - Cactus - EvilCorp* - Scattered Spider* - FiveHands - Cinnamon Tempest - EMBER BEA - Gamaredon","Data Exfiltration","https://github.com/rclone/rclone","1","1","N/A","N/A","8","10","49104","4366","2025-02-28T12:22:51Z","2014-03-16T16:19:57Z"
"*rclone-beta-latest-windows-amd64.zip*",".{0,1000}rclone\-beta\-latest\-windows\-amd64\.zip.{0,1000}","greyware_tool_keyword","rclone","Rclone is a command line program for syncing files with cloud storage services - abused by a lot of ransomware groups","T1567.002 - T1560.001 - T1030 - T1048.002 - T1048.003 - T1567.002 - T1083","TA0010","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - Karakurt - AvosLocker - LockBit - BianLian - Hive - Daixin - Conti - Dagon Locker - Trigona - Quantum - Revil - 8BASE - INC Ransom - Cactus - EvilCorp* - Scattered Spider* - FiveHands - Cinnamon Tempest - EMBER BEA - Gamaredon","Data Exfiltration","https://github.com/rclone/rclone","1","1","N/A","N/A","8","10","49104","4366","2025-02-28T12:22:51Z","2014-03-16T16:19:57Z"
"*rclone-current-windows-arm64.zip*",".{0,1000}rclone\-current\-windows\-arm64\.zip.{0,1000}","greyware_tool_keyword","rclone","Rclone is a command line program for syncing files with cloud storage services - abused by a lot of ransomware groups","T1567.002 - T1560.001 - T1030 - T1048.002 - T1048.003 - T1567.002 - T1083","TA0010","N/A","Dispossessor - BlackSuit - Royal - Black Basta - Akira - Karakurt - AvosLocker - LockBit - BianLian - Hive - Daixin - Conti - Dagon Locker - Trigona - Quantum - Revil - 8BASE - INC Ransom - Cactus - EvilCorp* - Scattered Spider* - FiveHands - Cinnamon Tempest - EMBER BEA - Gamaredon","Data Exfiltration","https://github.com/rclone/rclone","1","1","N/A","N/A","8","10","49104","4366","2025-02-28T12:22:51Z","2014-03-16T16:19:57Z"
"*rd-asia-au-1.pulseway.com*",".{0,1000}rd\-asia\-au\-1\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-eu-de-1.pulseway.com*",".{0,1000}rd\-eu\-de\-1\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-eu-ie-1.pulseway.com*",".{0,1000}rd\-eu\-ie\-1\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-us-east-1.pulseway.com*",".{0,1000}rd\-us\-east\-1\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-us-east-2.pulseway.com*",".{0,1000}rd\-us\-east\-2\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-us-west-1.pulseway.com*",".{0,1000}rd\-us\-west\-1\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*realtime.ably.io*",".{0,1000}realtime\.ably\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*relay-*.net.anydesk.com*",".{0,1000}relay\-.{0,1000}\.net\.anydesk\.com.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","1","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*-relay.screenconnect.com*",".{0,1000}\-relay\.screenconnect\.com.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*relays.syncthing.net*",".{0,1000}relays\.syncthing\.net.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*remiflavien1/nse-install*",".{0,1000}remiflavien1\/nse\-install.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*Remote AccessECompatibility.exe*",".{0,1000}Remote\sAccessECompatibility\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux32arm-offline.tar*",".{0,1000}Remote\sAccess\-linux32arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux32arm-online.tar*",".{0,1000}Remote\sAccess\-linux32arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux32-offline.tar*",".{0,1000}Remote\sAccess\-linux32\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux32-online.tar*",".{0,1000}Remote\sAccess\-linux32\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux64arm-offline.tar*",".{0,1000}Remote\sAccess\-linux64arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux64arm-online.tar*",".{0,1000}Remote\sAccess\-linux64arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux64-offline.tar*",".{0,1000}Remote\sAccess\-linux64\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux64-online.tar*",".{0,1000}Remote\sAccess\-linux64\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-macos-intel-offline.dmg*",".{0,1000}Remote\sAccess\-macos\-intel\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-macos-intel-online.dmg*",".{0,1000}Remote\sAccess\-macos\-intel\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-macos-offline.dmg*",".{0,1000}Remote\sAccess\-macos\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-macos-online.dmg*",".{0,1000}Remote\sAccess\-macos\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-windows32-offline.exe*",".{0,1000}Remote\sAccess\-windows32\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-windows32-online.exe*",".{0,1000}Remote\sAccess\-windows32\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-windows64-offline.exe*",".{0,1000}Remote\sAccess\-windows64\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remote access-windows64-online.exe*",".{0,1000}remote\saccess\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-windows64-online.exe*",".{0,1000}Remote\sAccess\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-java-online.jar*",".{0,1000}Remote\sSupport\-java\-online\.jar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux32arm-offline.tar*",".{0,1000}Remote\sSupport\-linux32arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux32arm-online.tar*",".{0,1000}Remote\sSupport\-linux32arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux32-offline.tar*",".{0,1000}Remote\sSupport\-linux32\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux32-online.tar*",".{0,1000}Remote\sSupport\-linux32\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux64arm-offline.tar*",".{0,1000}Remote\sSupport\-linux64arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux64arm-online.tar*",".{0,1000}Remote\sSupport\-linux64arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux64-offline.tar*",".{0,1000}Remote\sSupport\-linux64\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux64-online.tar*",".{0,1000}Remote\sSupport\-linux64\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-macos-intel-offline.dmg*",".{0,1000}Remote\sSupport\-macos\-intel\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-macos-intel-online.dmg*",".{0,1000}Remote\sSupport\-macos\-intel\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-macos-offline.dmg*",".{0,1000}Remote\sSupport\-macos\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-macos-online.dmg*",".{0,1000}Remote\sSupport\-macos\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-windows32-offline.exe*",".{0,1000}Remote\sSupport\-windows32\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-windows32-online.exe*",".{0,1000}Remote\sSupport\-windows32\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-windows64-offline.exe*",".{0,1000}Remote\sSupport\-windows64\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remote support-windows64-online.exe*",".{0,1000}remote\ssupport\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-windows64-online.exe*",".{0,1000}Remote\sSupport\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remote work-windows64-online.exe*",".{0,1000}remote\swork\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Work-windows64-online.exe*",".{0,1000}Remote\sWork\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remotedesktop.google.com/access*",".{0,1000}remotedesktop\.google\.com\/access.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remotedesktop.google.com/support*",".{0,1000}remotedesktop\.google\.com\/support.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteDesktop_x64 (1).msi*",".{0,1000}RemoteDesktop_x64\s\(1\)\.msi.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteDesktop_x64.msi*",".{0,1000}RemoteDesktop_x64\.msi.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remoteit/installer*",".{0,1000}remoteit\/installer.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/installer","1","1","N/A","N/A","10","10","24","9","2024-04-17T00:45:45Z","2019-01-29T21:06:02Z"
"*remoteit/remoteit-agent*",".{0,1000}remoteit\/remoteit\-agent.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/installer","1","1","N/A","N/A","10","10","24","9","2024-04-17T00:45:45Z","2019-01-29T21:06:02Z"
"*remoteit-amd64-installer.deb*",".{0,1000}remoteit\-amd64\-installer\.deb.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/desktop","1","1","N/A","N/A","10","10","44","11","2025-01-22T07:41:56Z","2019-01-12T00:59:20Z"
"*remoteit-installer.exe*",".{0,1000}remoteit\-installer\.exe.{0,1000}","greyware_tool_keyword","remoteit","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/remoteit/desktop","1","1","N/A","N/A","10","10","44","11","2025-01-22T07:41:56Z","2019-01-12T00:59:20Z"
"*RemotePC (1).exe*",".{0,1000}RemotePC\s\(1\)\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePC.WebSockets.dll*",".{0,1000}RemotePC\.WebSockets\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCAttended.exe*",".{0,1000}RemotePCAttended\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCAttendedService*",".{0,1000}RemotePCAttendedService.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCBlackScreenApp.exe*",".{0,1000}RemotePCBlackScreenApp\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCCopyPaste.txt*",".{0,1000}RemotePCCopyPaste\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCDesktop.exe*",".{0,1000}RemotePCDesktop\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCDesktop.txt*",".{0,1000}RemotePCDesktop\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCHDDesktop.txt*",".{0,1000}RemotePCHDDesktop\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCHDService.txt*",".{0,1000}RemotePCHDService\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCModules.log*",".{0,1000}RemotePCModules\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","#logfile","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCPerformanceWebLauncher.exe*",".{0,1000}RemotePCPerformanceWebLauncher\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCPrinting.exe*",".{0,1000}RemotePCPrinting\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCPrintView.exe*",".{0,1000}RemotePCPrintView\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCProxys.dat*",".{0,1000}RemotePCProxys\.dat.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCService.exe*",".{0,1000}RemotePCService\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCService.txt*",".{0,1000}RemotePCService\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCService_2.txt*",".{0,1000}RemotePCService_2\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCShortcut.exe*",".{0,1000}RemotePCShortcut\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCSuite.Model.dll*",".{0,1000}RemotePCSuite\.Model\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteScanner.exe*",".{0,1000}RemoteScanner\.exe.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner and Earth Lusca Operations Tools and commands","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf https://github.com/vletoux/pingcastle","1","1","N/A","N/A","10","","N/A","","",""
"*rest.ably.io*",".{0,1000}rest\.ably\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*restic/restic:latest*",".{0,1000}restic\/restic\:latest.{0,1000}","greyware_tool_keyword","restic","backup program used by threat actors for data exfiltration","T1567","TA0009 - TA0010","N/A","INC Ransom - Lynx","Data Exfiltration","https://github.com/restic/restic","1","1","N/A","N/A","8","10","27784","1585","2025-03-01T01:53:27Z","2014-04-27T14:07:58Z"
"*restic_*_windows_amd64.exe*",".{0,1000}restic_.{0,1000}_windows_amd64\.exe.{0,1000}","greyware_tool_keyword","restic","backup program used by threat actors for data exfiltration","T1567","TA0009 - TA0010","N/A","INC Ransom - Lynx","Data Exfiltration","https://github.com/restic/restic","1","1","N/A","N/A","8","10","27784","1585","2025-03-01T01:53:27Z","2014-04-27T14:07:58Z"
"*rl.ammyy.com/*",".{0,1000}rl\.ammyy\.com\/.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rmm.barracudamsp.com*",".{0,1000}rmm\.barracudamsp\.com.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RMM.WebRemote.exe*",".{0,1000}RMM\.WebRemote\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*robbie-cahill/tunnelmole-client*",".{0,1000}robbie\-cahill\/tunnelmole\-client.{0,1000}","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*robertdavidgraham/rdpscan*",".{0,1000}robertdavidgraham\/rdpscan.{0,1000}","greyware_tool_keyword","rdpscan","A quick scanner for the CVE-2019-0708 ""BlueKeep"" vulnerability","T1210 - T1046","TA0001 - TA0008","N/A","Dispossessor","Discovery","https://github.com/robertdavidgraham/rdpscan","1","1","N/A","N/A","6","10","904","243","2019-06-22T21:48:45Z","2019-05-23T22:50:12Z"
"*ROCAVulnerabilityTester*",".{0,1000}ROCAVulnerabilityTester.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner and Earth Lusca Operations Tools and commands","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf https://github.com/vletoux/pingcastle","1","1","N/A","N/A","10","","N/A","","",""
"*rootcert.meshcentral.com*",".{0,1000}rootcert\.meshcentral\.com.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*RPCDownloaderLogFile.txt*",".{0,1000}RPCDownloaderLogFile\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCFireWallRule.exe*",".{0,1000}RPCFireWallRule\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCFireWallRulelogfile.txt*",".{0,1000}RPCFireWallRulelogfile\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCKeyMouseHandler.txt*",".{0,1000}RPCKeyMouseHandler\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rpcperformanceservice.exe*",".{0,1000}rpcperformanceservice\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCPerformanceService.exe*",".{0,1000}RPCPerformanceService\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCPerfViewer.log*",".{0,1000}RPCPerfViewer\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","#logfile","N/A","10","10","N/A","N/A","N/A","N/A"
"*rpcprinterdownloader.exe*",".{0,1000}rpcprinterdownloader\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rs-ny.rustdesk.com*",".{0,1000}rs\-ny\.rustdesk\.com.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","network request after installation","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*rsocks/server.py*",".{0,1000}rsocks\/server\.py.{0,1000}","greyware_tool_keyword","rsocks","A SOCKS 4/5 reverse proxy server","T1090 - T1571 - T1071 - T1095","TA0011 - TA0001 - TA0008","N/A","Scattered Spider*","C2","https://github.com/tonyseek/rsocks","1","1","N/A","N/A","10","10","130","13","2022-09-20T07:11:29Z","2015-03-08T22:31:31Z"
"*RuntimeBroker_rustdesk.exe*",".{0,1000}RuntimeBroker_rustdesk\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*rustdesk-*-win7-install.exe*",".{0,1000}rustdesk\-.{0,1000}\-win7\-install\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*RustDesk_install.bat*",".{0,1000}RustDesk_install\.bat.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*rustdesk_portable.exe*",".{0,1000}rustdesk_portable\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*RustDesk_uninstall.bat*",".{0,1000}RustDesk_uninstall\.bat.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*RustDeskIddDriver.cer*",".{0,1000}RustDeskIddDriver\.cer.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*RustDeskIddDriver.dll*",".{0,1000}RustDeskIddDriver\.dll.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*rustdesk-portable-packer.exe*",".{0,1000}rustdesk\-portable\-packer\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","83196","11656","2025-03-02T10:04:22Z","2020-09-28T15:36:08Z"
"*sanalytics.box.com*",".{0,1000}sanalytics\.box\.com.{0,1000}","greyware_tool_keyword","Box","Attackers have used box to store malicious files and then share them with targets - box can also be used for data exfiltration by attackers","T1567.002 - T1071.001 - T1036 - T1048.002","TA0005 - TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://app.box.com/","1","1","N/A","N/A","6","7","N/A","N/A","N/A","N/A"
"*sandialabs/wiretap*",".{0,1000}sandialabs\/wiretap.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*sc0tfree/updog*",".{0,1000}sc0tfree\/updog.{0,1000}","greyware_tool_keyword","updog","Updog is a replacement for SimpleHTTPServer. It allows uploading and downloading via HTTP/S can set ad hoc SSL certificates and use http basic auth.","T1567 - T1074.001 - T1020","TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://github.com/sc0tfree/updog","1","1","N/A","N/A","9","10","3013","311","2024-03-13T15:52:39Z","2020-02-18T15:29:21Z"
"*schollz/croc*",".{0,1000}schollz\/croc.{0,1000}","greyware_tool_keyword","croc","croc is a tool that allows any two computers to simply and securely transfer files and folders","T1567.002 - T1090.002 - T1573.002 - T1102.003","TA0010 - TA0005 - TA0008 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/schollz/croc","1","1","N/A","N/A","8","10","28838","1143","2025-02-25T09:03:12Z","2017-10-17T15:20:18Z"
"*ScreenConnect.ClientService.exe*",".{0,1000}ScreenConnect\.ClientService\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.ClientSetup.exe*",".{0,1000}ScreenConnect\.ClientSetup\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.Core.pdb*",".{0,1000}ScreenConnect\.Core\.pdb.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect_*_Release.msi*",".{0,1000}ScreenConnect_.{0,1000}_Release\.msi.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect_*_Release.tar.gz*",".{0,1000}ScreenConnect_.{0,1000}_Release\.tar\.gz.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect_*_Release.zip*",".{0,1000}ScreenConnect_.{0,1000}_Release\.zip.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*server*-relay.screenconnect.com*",".{0,1000}server.{0,1000}\-relay\.screenconnect\.com.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","screenconnect.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*server.remoteutilities.com*",".{0,1000}server\.remoteutilities\.com.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*serverinfo.alpemix.com*",".{0,1000}serverinfo\.alpemix\.com.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*service.tunnelmole.com*",".{0,1000}service\.tunnelmole\.com.{0,1000}","greyware_tool_keyword","tunnelmole-client","tmole - Share your local server with a Public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/robbie-cahill/tunnelmole-client/","1","1","N/A","N/A","10","10","1344","83","2025-02-11T09:18:26Z","2023-02-08T08:27:57Z"
"*shadawck/nse-install*",".{0,1000}shadawck\/nse\-install.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*Shadowsocks.Protocol*",".{0,1000}Shadowsocks\.Protocol.{0,1000}","greyware_tool_keyword","shadowsocks","shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-windows","1","1","N/A","N/A","10","10","58635","16369","2025-01-01T08:09:55Z","2013-01-14T07:54:16Z"
"*shadowsocks/shadowsocks-rust*",".{0,1000}shadowsocks\/shadowsocks\-rust.{0,1000}","greyware_tool_keyword","shadowsocks","Rust port - shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-rust","1","1","N/A","N/A","10","10","9082","1253","2025-03-02T14:57:16Z","2014-10-15T11:02:36Z"
"*shadowsocks/shadowsocks-windows*",".{0,1000}shadowsocks\/shadowsocks\-windows.{0,1000}","greyware_tool_keyword","shadowsocks","shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-windows","1","1","N/A","N/A","10","10","58635","16369","2025-01-01T08:09:55Z","2013-01-14T07:54:16Z"
"*shadowsocks/ssserver-rust*",".{0,1000}shadowsocks\/ssserver\-rust.{0,1000}","greyware_tool_keyword","shadowsocks","Rust port - shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-rust","1","1","N/A","N/A","10","10","9082","1253","2025-03-02T14:57:16Z","2014-10-15T11:02:36Z"
"*share.zrok.io*",".{0,1000}share\.zrok\.io.{0,1000}","greyware_tool_keyword","zrok","zrok allows users to share tunnels for HTTP TCP and UDP network resources. zrok additionally allows users to easily and rapidly share files - web content and custom resources in a peer-to-peer manner.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/openziti/zrok","1","1","N/A","N/A","10","10","3003","119","2025-02-28T15:48:39Z","2022-07-18T19:14:51Z"
"*simplehelp remote work.exe*",".{0,1000}simplehelp\sremote\swork\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelp remote workwinlauncher.exe*",".{0,1000}simplehelp\sremote\sworkwinlauncher\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Remote WorkWinLauncher.exe*",".{0,1000}SimpleHelp\sRemote\sWorkWinLauncher\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician.exe*",".{0,1000}SimpleHelp\sTechnician\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelp technician.exe*",".{0,1000}simplehelp\stechnician\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-java-online.jar*",".{0,1000}SimpleHelp\sTechnician\-java\-online\.jar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux32arm-offline.tar*",".{0,1000}SimpleHelp\sTechnician\-linux32arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux32arm-online.tar*",".{0,1000}SimpleHelp\sTechnician\-linux32arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux32-offline.tar*",".{0,1000}SimpleHelp\sTechnician\-linux32\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux32-online.tar*",".{0,1000}SimpleHelp\sTechnician\-linux32\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux64arm-offline.tar*",".{0,1000}SimpleHelp\sTechnician\-linux64arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux64arm-online.tar*",".{0,1000}SimpleHelp\sTechnician\-linux64arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux64-offline.tar*",".{0,1000}SimpleHelp\sTechnician\-linux64\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux64-online.tar*",".{0,1000}SimpleHelp\sTechnician\-linux64\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-macos-intel-offline.dmg*",".{0,1000}SimpleHelp\sTechnician\-macos\-intel\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-macos-intel-online.dmg*",".{0,1000}SimpleHelp\sTechnician\-macos\-intel\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-macos-offline.dmg*",".{0,1000}SimpleHelp\sTechnician\-macos\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-macos-online.dmg*",".{0,1000}SimpleHelp\sTechnician\-macos\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","#macos","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-windows32-offline.exe*",".{0,1000}SimpleHelp\sTechnician\-windows32\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-windows32-online.exe*",".{0,1000}SimpleHelp\sTechnician\-windows32\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-windows64-offline.exe*",".{0,1000}SimpleHelp\sTechnician\-windows64\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelp technician-windows64-online.exe*",".{0,1000}simplehelp\stechnician\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-windows64-online.exe*",".{0,1000}SimpleHelp\sTechnician\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelp technicianwinlauncher.exe*",".{0,1000}simplehelp\stechnicianwinlauncher\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp.exe*",".{0,1000}SimpleHelp\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp-allplatforms.zip*",".{0,1000}SimpleHelp\-allplatforms\.zip.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp-install-64.exe*",".{0,1000}SimpleHelp\-install\-64\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*skx/tunneller*",".{0,1000}skx\/tunneller.{0,1000}","greyware_tool_keyword","tunneller","Tunneller allows you to expose services which are running on localhost or on your local network to the public internet.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/skx/tunneller","1","1","N/A","N/A","10","10","481","41","2024-08-13T07:36:22Z","2019-04-21T11:05:11Z"
"*SmbScanner.exe*",".{0,1000}SmbScanner\.exe.{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner and Earth Lusca Operations Tools and commands","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf https://github.com/vletoux/pingcastle","1","1","N/A","N/A","10","","N/A","","",""
"*snsinfu/reverse-tunnel*",".{0,1000}snsinfu\/reverse\-tunnel.{0,1000}","greyware_tool_keyword","reverse-tunnel","rtun is a tool for exposing TCP and UDP ports to the Internet via a public gateway server. You can expose ssh and mosh server on a machine behind firewall and NAT.","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/snsinfu/reverse-tunnel","1","1","N/A","N/A","10","10","205","42","2023-10-15T07:29:32Z","2018-07-09T21:41:50Z"
"*socket(S*PF_INET*SOCK_STREAM*getprotobyname(*tcp*))*if(connect(S*sockaddr_in($p*inet_aton($i))))*",".{0,1000}socket\(S.{0,1000}PF_INET.{0,1000}SOCK_STREAM.{0,1000}getprotobyname\(.{0,1000}tcp.{0,1000}\)\).{0,1000}if\(connect\(S.{0,1000}sockaddr_in\(\$p.{0,1000}inet_aton\(\$i\)\)\)\).{0,1000}","greyware_tool_keyword","shell","Reverse Shell Command Line","T1105 - T1021.001 - T1021.002","TA0002 - TA0008","N/A","N/A","C2","https://github.com/SigmaHQ/sigma/blob/master/rules/linux/lnx_shell_susp_rev_shells.yml","1","1","N/A","greyware tool - risks of False positive !","N/A","10","8754","2277","2025-03-01T02:09:17Z","2016-12-24T09:48:49Z"
"*SoftEtherVPN/SoftEtherVPN_Stable.git*",".{0,1000}SoftEtherVPN\/SoftEtherVPN_Stable\.git.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*SolarWinds-Dameware-DRS-St.exe*",".{0,1000}SolarWinds\-Dameware\-DRS\-St\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-DRS-St-Eval.zip*",".{0,1000}SolarWinds\-Dameware\-DRS\-St\-Eval\.zip.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-MRC-32bit-St.exe*",".{0,1000}SolarWinds\-Dameware\-MRC\-32bit\-St\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-MRC-32bit-St-Eval.zip*",".{0,1000}SolarWinds\-Dameware\-MRC\-32bit\-St\-Eval\.zip.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-MRC-64bit-St.exe*",".{0,1000}SolarWinds\-Dameware\-MRC\-64bit\-St\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-MRC-64bit-St-Eval.zip*",".{0,1000}SolarWinds\-Dameware\-MRC\-64bit\-St\-Eval\.zip.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*somenonymous/OshiUpload*",".{0,1000}somenonymous\/OshiUpload.{0,1000}","greyware_tool_keyword","OshiUpload","Ephemeral file sharing engine","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Black Basta","Data Exfiltration","https://github.com/somenonymous/OshiUpload","1","1","#filehostingservice #P2P","N/A","10","2","188","26","2022-10-01T04:08:29Z","2019-05-11T02:08:51Z"
"*sourceforge.net/projects/eraser/files/Eraser*/download*",".{0,1000}sourceforge\.net\/projects\/eraser\/files\/Eraser.{0,1000}\/download.{0,1000}","greyware_tool_keyword","eraser","It completely removes sensitive data from your hard drive by overwriting it several times with carefully selected patterns - abusedby attackers for anti forensic","T1070 - T1488 - T1561","TA0005","N/A","BlackSuit - Royal","Defense Evasion","https://sourceforge.net/projects/eraser","1","1","N/A","N/A","7","10","N/A","N/A","N/A","N/A"
"*src/gotunnelme/*",".{0,1000}src\/gotunnelme\/.{0,1000}","greyware_tool_keyword","localtunnel","localtunnel exposes your localhost to the world","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/NoahShen/gotunnelme","1","1","N/A","N/A","10","10","170","46","2018-01-06T04:41:15Z","2013-10-18T02:46:51Z"
"*src/xmrig.cpp*",".{0,1000}src\/xmrig\.cpp.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*ss_privoxy.exe*",".{0,1000}ss_privoxy\.exe.{0,1000}","greyware_tool_keyword","shadowsocks","shadowsocks is a fast tunnel proxy that helps you bypass firewalls","T1572 - T1090","TA0011 - TA0005","N/A","N/A","C2","https://github.com/shadowsocks/shadowsocks-windows","1","1","N/A","N/A","10","10","58635","16369","2025-01-01T08:09:55Z","2013-01-14T07:54:16Z"
"*sshjmpnoutfqotbj6r3acexiwoalgkth55y5kys7js3px2qqqrwuhqqd.onion*",".{0,1000}sshjmpnoutfqotbj6r3acexiwoalgkth55y5kys7js3px2qqqrwuhqqd\.onion.{0,1000}","greyware_tool_keyword","SSH-J.com","This is Dropbear SSH server modified to be used as a public SSH jump & port forwarding service","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://bitbucket.org/ValdikSS/dropbear-sshj/src/master/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sshtunnel.readthedocs.io*",".{0,1000}sshtunnel\.readthedocs\.io.{0,1000}","greyware_tool_keyword","sshtunnel","SSH tunnels to remote server","T1572 - T1219","TA0005 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://github.com/pahaz/sshtunnel","1","1","N/A","N/A","10","10","1246","185","2024-03-10T15:20:42Z","2014-06-11T21:14:05Z"
"*sshtunnel.readthedocs.org*",".{0,1000}sshtunnel\.readthedocs\.org.{0,1000}","greyware_tool_keyword","sshtunnel","SSH tunnels to remote server","T1572 - T1219","TA0005 - TA0010 - TA0011","N/A","N/A","Defense Evasion","https://github.com/pahaz/sshtunnel","1","1","N/A","N/A","10","10","1246","185","2024-03-10T15:20:42Z","2014-06-11T21:14:05Z"
"*sshuttle/sshuttle*",".{0,1000}sshuttle\/sshuttle.{0,1000}","greyware_tool_keyword","sshuttle","Transparent proxy server that works as a poor man's VPN. Forwards over ssh","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://github.com/sshuttle/sshuttle","1","1","#linux","N/A","10","10","12039","752","2025-03-02T09:39:56Z","2014-09-15T04:51:13Z"
"*sshx-server-*.tar.gz*",".{0,1000}sshx\-server\-.{0,1000}\.tar\.gz.{0,1000}","greyware_tool_keyword","sshx","Fast collaborative live terminal sharing over the web","T1021.004 - T1041 - T1059 - T1071.001","TA0002 - TA0009 - TA0011 - TA0010","N/A","N/A","C2","https://github.com/ekzhang/sshx","1","1","N/A","N/A","10","10","6284","208","2025-02-12T20:40:30Z","2022-02-12T23:29:33Z"
"*staqlab-tunnel.exe*",".{0,1000}staqlab\-tunnel\.exe.{0,1000}","greyware_tool_keyword","staqlab-tunnel","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/cocoflan/Staqlab-tunnel","1","1","N/A","N/A","10","10","1","0","2020-05-19T06:43:14Z","2020-05-19T06:19:31Z"
"*staqlab-tunnel.zip*",".{0,1000}staqlab\-tunnel\.zip.{0,1000}","greyware_tool_keyword","staqlab-tunnel","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/cocoflan/Staqlab-tunnel","1","1","N/A","N/A","10","10","1","0","2020-05-19T06:43:14Z","2020-05-19T06:19:31Z"
"*stascorp/rdpwrap*",".{0,1000}stascorp\/rdpwrap.{0,1000}","greyware_tool_keyword","rdpwrap","RDP Wrapper Library used by malwares","T1021","TA0008","N/A","N/A","Lateral Movement","https://github.com/stascorp/rdpwrap","1","1","N/A","N/A","10","10","15129","3891","2024-06-18T15:08:33Z","2014-10-22T23:18:28Z"
"*static.remotepc.com*",".{0,1000}static\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*stderr.pl/oset*",".{0,1000}stderr\.pl\/oset.{0,1000}","greyware_tool_keyword","oset","Offline SAM Editor Tool to  access and edit SAM databases from offline OS disk","T1078 - T1003.002 - T1547.001","TA0003 - TA0006 - TA0007 - TA0005","N/A","N/A","Credential Access","https://x.com/0gtweet/status/1817859483445461406","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*StorageExplorer-linux-x64.tar.gz*",".{0,1000}StorageExplorer\-linux\-x64\.tar\.gz.{0,1000}","greyware_tool_keyword","Azure Storage Explorer","legitimate microsoft software - threat actors have been abusing Azure Storage Explorer for Data Exfiltration","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Rhysida","Data Exfiltration","https://azure.microsoft.com/en-us/products/storage/storage-explorer","1","1","#linux","N/A","8","10","N/A","N/A","N/A","N/A"
"*StorageExplorer-windows-x64.exe*",".{0,1000}StorageExplorer\-windows\-x64\.exe.{0,1000}","greyware_tool_keyword","Azure Storage Explorer","legitimate microsoft software - threat actors have been abusing Azure Storage Explorer for Data Exfiltration","T1030 - T1048 - T1078.004 - T1105 - T1567.001","TA0010","N/A","Rhysida","Data Exfiltration","https://azure.microsoft.com/en-us/products/storage/storage-explorer","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*stun.syncthing.net*",".{0,1000}stun\.syncthing\.net.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*support.radmin.com*",".{0,1000}support\.radmin\.com.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Support-LogMeInRescue.exe*",".{0,1000}Support\-LogMeInRescue\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Support-LogMeInRescue.exe*",".{0,1000}Support\-LogMeInRescue\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*supremogw*.nanosystems.it*",".{0,1000}supremogw.{0,1000}\.nanosystems\.it.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","1","N/A","agent network connection ","10","10","N/A","N/A","N/A","N/A"
"*supremohelper.exe*",".{0,1000}supremohelper\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SupremoService.exe*",".{0,1000}SupremoService\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SupremoSystem.exe*",".{0,1000}SupremoSystem\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*swarleysez/AD-common-queries*",".{0,1000}swarleysez\/AD\-common\-queries.{0,1000}","greyware_tool_keyword","AD-common-queries","Collection of common ADSI queries for Domain Account enumeration","T1087 - T1087.002 - T1018 - T1069 - T1069.002 - T1069.003 - T1133 - T1139","TA0007 - TA0009","N/A","N/A","Discovery","https://github.com/swarleysez/AD-common-queries","1","1","N/A","N/A","8","1","7","3","2020-05-24T03:23:09Z","2020-03-10T19:43:51Z"
"*swarm.meshcentral.com*",".{0,1000}swarm\.meshcentral\.com.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*switch.ehorus.com*",".{0,1000}switch\.ehorus\.com.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*syncthing-windows-setup.exe*",".{0,1000}syncthing\-windows\-setup\.exe.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*tacticalrmm-develop*",".{0,1000}tacticalrmm\-develop.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider* - Black Basta","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3435","472","2025-02-27T00:52:54Z","2019-10-22T22:19:12Z"
"*taf.teamviewer.com*",".{0,1000}taf\.teamviewer\.com.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*tailscale.com/install.sh*",".{0,1000}tailscale\.com\/install\.sh.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*tailscale.com/logger.Logf*",".{0,1000}tailscale\.com\/logger\.Logf.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*tailscale/go/releases/download/*",".{0,1000}tailscale\/go\/releases\/download\/.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*tailscale/net/dns/",".{0,1000}tailscale\/net\/dns\/","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*tailscale/tailscale.go*",".{0,1000}tailscale\/tailscale\.go.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*tailscaled.exe*",".{0,1000}tailscaled\.exe.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*tailscaled.log*",".{0,1000}tailscaled\.log.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","#logfile","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*tailscaled.sh*",".{0,1000}tailscaled\.sh.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*tailscaled.stdout.log*",".{0,1000}tailscaled\.stdout\.log.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","#logfile","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*tailscale-ipn.log.conf*",".{0,1000}tailscale\-ipn\.log\.conf.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*tailscale-setup-full-*.exe*",".{0,1000}tailscale\-setup\-full\-.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","tailscale","Tailscale connects your team's devices and development environments for easy access to remote resources.","T1021 - T1573 ","TA0005 - TA0001 - TA0010 ","N/A","Scattered Spider*","Defense Evasion","https://github.com/tailscale/tailscale","1","1","N/A","N/A","9","10","21222","1700","2025-03-02T02:00:58Z","2020-01-31T22:00:03Z"
"*takeshixx/nmap-scripts*",".{0,1000}takeshixx\/nmap\-scripts.{0,1000}","greyware_tool_keyword","nmap","Install and update external NSE script for nmap","T1595 - T1592 - T1589 - T1590 - T1591 - T1190 - T1059 - T1046 - T1016 - T1049 - T1007","TA0001 - TA0007 - TA0043","N/A","Qilin - Cactus - EMBER BEAR - ENERGETIC BEAR - MUSTANG PANDA - TA2101 - FIN13 - Black Basta","Vulnerability Scanner","https://github.com/shadawck/nse-install","1","1","N/A","N/A","7","1","6","1","2020-08-28T11:27:08Z","2020-08-24T16:55:55Z"
"*TeamViewer_Desktop.exe*",".{0,1000}TeamViewer_Desktop\.exe.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer_Setup_x64.exe*",".{0,1000}TeamViewer_Setup_x64\.exe.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewerMeetingAddIn.dll*",".{0,1000}TeamViewerMeetingAddIn\.dll.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewerMeetingAddinShim.dll*",".{0,1000}TeamViewerMeetingAddinShim\.dll.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewerMeetingAddinShim64.dll*",".{0,1000}TeamViewerMeetingAddinShim64\.dll.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*techws.*.swi-rc.com*",".{0,1000}techws\..{0,1000}\.swi\-rc\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*test.endpoint.rapid7.com*",".{0,1000}test\.endpoint\.rapid7\.com.{0,1000}","greyware_tool_keyword","rapid7","Vulnerability scanner","T1046 - T1068 - T1190 - T1201 - T1222 - T1592","TA0001 - TA0002 - TA0007 - TA0011","N/A","Black Basta","Vulnerability Scanner","https://www.rapid7.com/","1","1","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
"*test-cloudflare-tunnel-cert-json.pem*",".{0,1000}test\-cloudflare\-tunnel\-cert\-json\.pem.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","N/A","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*testing.ssi.sh*",".{0,1000}testing\.ssi\.sh.{0,1000}","greyware_tool_keyword","sish","HTTP(S)/WS(S)/TCP Tunnels to localhost using only SSH.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/antoniomika/sish","1","1","N/A","N/A","10","10","4134","317","2025-02-23T16:05:12Z","2019-02-15T15:36:23Z"
"*thebookisclosed/AmperageKit*",".{0,1000}thebookisclosed\/AmperageKit.{0,1000}","greyware_tool_keyword","AmperageKit","enabling Recall in Windows 11 version 24H2 on unsupported devices","T1005 - T1113 - T1056.001 - T1003","TA0009 - TA0010 - TA0006 - TA0007","N/A","N/A","Sniffing & Spoofing","https://github.com/thebookisclosed/AmperageKit","1","1","N/A","N/A","8","4","398","27","2024-06-21T16:37:12Z","2024-05-30T23:00:45Z"
"*tmate/tmate-ssh-server*",".{0,1000}tmate\/tmate\-ssh\-server.{0,1000}","greyware_tool_keyword","tmate","Instant terminal sharing","T1071 - T1105 - T1573 - T1021","TA0010 - TA0011 - TA0008 - TA0002","N/A","WatchDog","C2","https://github.com/tmate-io/tmate-ssh-server","1","1","#linux","N/A","10","10","639","146","2024-06-21T11:52:24Z","2013-06-09T23:58:55Z"
"*tmate-io/tmate*",".{0,1000}tmate\-io\/tmate.{0,1000}","greyware_tool_keyword","tmate","Instant terminal sharing","T1071 - T1105 - T1573 - T1021","TA0010 - TA0011 - TA0008 - TA0002","N/A","WatchDog","C2","https://github.com/tmate-io/tmate-ssh-server","1","1","#linux","N/A","10","10","639","146","2024-06-21T11:52:24Z","2013-06-09T23:58:55Z"
"*tonyseek/rsocks*",".{0,1000}tonyseek\/rsocks.{0,1000}","greyware_tool_keyword","rsocks","A SOCKS 4/5 reverse proxy server","T1090 - T1571 - T1071 - T1095","TA0011 - TA0001 - TA0008","N/A","Scattered Spider*","C2","https://github.com/tonyseek/rsocks","1","1","N/A","N/A","10","10","130","13","2022-09-20T07:11:29Z","2015-03-08T22:31:31Z"
"*tools/adfind*",".{0,1000}tools\/adfind.{0,1000}","greyware_tool_keyword","adfind","Adfind is a command-line tool often used by administrators for Active Directory queries. However. attackers can misuse it to gather valuable information about the network environment. including user accounts. group memberships. domain controllers. and domain trusts. This gathered intelligence can aid in Lateral Movement. privilege escalation. or even data exfiltration. Such reconnaissance activities often precede more damaging attacks.","T1087 - T1016 - T1482","TA0007 - TA0008 - TA0043","N/A","APT29 - Akira - Black Basta - BlackSuit - Conti - COZY BEAR - Dagon Locker - Diavol - FIN6 - FIN7 - INC Ransom - LockBit - MAZE - MUSTANG PANDA - NetWalker - Nokoyawa - PLAY - Quantum - REvil - Royal - Ryuk - TA505 - TRAVELING SPIDER - Unit 29155 - WIZARD SPIDER - Wizard Spider - XingLocker - menuPass - Dispossessor","Discovery","https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/","1","1","N/A","greyware tool - risks of False positive !","10","10","N/A","N/A","N/A","N/A"
"*tshark*.deb*",".{0,1000}tshark.{0,1000}\.deb.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*tunnel.ap.ngrok.com*",".{0,1000}tunnel\.ap\.ngrok\.com.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","also seen in https://github.com/Velocidex/velociraptor-sigma-rules/blob/master/rules%2Flinux%2Fgeneric%2Fnetwork_connection%2Fnet_connection_lnx_ngrok_tunnel.yaml","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*tunnel.au.ngrok.com*",".{0,1000}tunnel\.au\.ngrok\.com.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","also seen in https://github.com/Velocidex/velociraptor-sigma-rules/blob/master/rules%2Flinux%2Fgeneric%2Fnetwork_connection%2Fnet_connection_lnx_ngrok_tunnel.yaml","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*tunnel.eu.ngrok.com*",".{0,1000}tunnel\.eu\.ngrok\.com.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","also seen in https://github.com/Velocidex/velociraptor-sigma-rules/blob/master/rules%2Flinux%2Fgeneric%2Fnetwork_connection%2Fnet_connection_lnx_ngrok_tunnel.yaml","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*tunnel.in.ngrok.com*",".{0,1000}tunnel\.in\.ngrok\.com.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","also seen in https://github.com/Velocidex/velociraptor-sigma-rules/blob/master/rules%2Flinux%2Fgeneric%2Fnetwork_connection%2Fnet_connection_lnx_ngrok_tunnel.yaml","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*tunnel.jp.ngrok.com*",".{0,1000}tunnel\.jp\.ngrok\.com.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","also seen in https://github.com/Velocidex/velociraptor-sigma-rules/blob/master/rules%2Flinux%2Fgeneric%2Fnetwork_connection%2Fnet_connection_lnx_ngrok_tunnel.yaml","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*tunnel.pyjam.as*",".{0,1000}tunnel\.pyjam\.as.{0,1000}","greyware_tool_keyword","tunnel.pyjam.as","SSL-terminated ephemeral HTTP tunnels to your local machine - no custom software required (thanks to wireguard)","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://gitlab.com/pyjam.as/tunnel","1","1","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*tunnel.sa.ngrok.com*",".{0,1000}tunnel\.sa\.ngrok\.com.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","also seen in https://github.com/Velocidex/velociraptor-sigma-rules/blob/master/rules%2Flinux%2Fgeneric%2Fnetwork_connection%2Fnet_connection_lnx_ngrok_tunnel.yaml","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*tunnel.staqlab.com*",".{0,1000}tunnel\.staqlab\.com.{0,1000}","greyware_tool_keyword","staqlab-tunnel","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/cocoflan/Staqlab-tunnel","1","1","N/A","N/A","10","10","1","0","2020-05-19T06:43:14Z","2020-05-19T06:19:31Z"
"*tunnel.us.ngrok.com*",".{0,1000}tunnel\.us\.ngrok\.com.{0,1000}","greyware_tool_keyword","ngrok","ngrok - abused by attackers for C2 usage","T1090 - T1095 - T1008 - T1102 - T1572 - T1567 - T1568.002","TA0011 - TA0010 - TA0005","N/A","Akira - BlackCat - Karakurt - Scattered Spider* - LockBit - Fox Kitten - LazyScripter - Unit 29155 - Common Raven - FoxKitten - Gamaredon - Dispossessor","C2","https://github.com/inconshreveable/ngrok","1","1","N/A","also seen in https://github.com/Velocidex/velociraptor-sigma-rules/blob/master/rules%2Flinux%2Fgeneric%2Fnetwork_connection%2Fnet_connection_lnx_ngrok_tunnel.yaml","10","10","24281","4279","2024-04-26T18:11:18Z","2013-03-20T09:37:43Z"
"*tunnel-api.staqlab.com*",".{0,1000}tunnel\-api\.staqlab\.com.{0,1000}","greyware_tool_keyword","staqlab-tunnel","Expose localhost to internet","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/cocoflan/Staqlab-tunnel","1","1","N/A","N/A","10","10","1","0","2020-05-19T06:43:14Z","2020-05-19T06:19:31Z"
"*tunnels-prod-rel-tm.trafficmanager.net*",".{0,1000}tunnels\-prod\-rel\-tm\.trafficmanager\.net.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*tunnels-prod-rel-tm.trafficmanager.net*",".{0,1000}tunnels\-prod\-rel\-tm\.trafficmanager\.net.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","0","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*tunnelto_server/src/*",".{0,1000}tunnelto_server\/src\/.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*tunnelto-linux.tar.gz*",".{0,1000}tunnelto\-linux\.tar\.gz.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","#linux","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*tunnelto-windows.exe*",".{0,1000}tunnelto\-windows\.exe.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*tunwg*wireguard.go*",".{0,1000}tunwg.{0,1000}wireguard\.go.{0,1000}","greyware_tool_keyword","tunwg","End to end encrypted secure tunnel to local servers","T1572 - T1048","TA0011 - TA0010 - TA0005","N/A","N/A","C2","https://github.com/ntnj/tunwg","1","1","N/A","N/A","10","10","233","9","2024-09-18T15:03:45Z","2023-01-16T17:51:13Z"
"*turn-*.zohomeeting.com*",".{0,1000}turn\-.{0,1000}\.zohomeeting\.com.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*turn.console.gotoassist.com*",".{0,1000}turn\.console\.gotoassist\.com.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*tvnserver.exe*",".{0,1000}tvnserver\.exe.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*tvnviewer.exe*",".{0,1000}tvnviewer\.exe.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*UCCAPI/16.0.13328.20130 OC/16.0.13426.20234*",".{0,1000}UCCAPI\/16\.0\.13328\.20130\sOC\/16\.0\.13426\.20234.{0,1000}","greyware_tool_keyword","lyncsmash","default user agent used by lyncsmash.py - a collection of tools to enumerate and attack self-hosted Skype for Business and Microsoft Lync installations ","T1190 - T1087 - T1110","TA0006 - TA0007","N/A","N/A","Credential Access","https://github.com/nyxgeek/lyncsmash","1","1","#useragent","greyware_tools high risks of false positives","8","4","335","64","2024-10-01T11:22:01Z","2016-05-20T04:32:41Z"
"*ui/rest/download/xeoxagentgeneric/*",".{0,1000}ui\/rest\/download\/xeoxagentgeneric\/.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*uks1.rel.tunnels.api.visualstudio.com*",".{0,1000}uks1\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*ulm.aeroadmin.com/*",".{0,1000}ulm\.aeroadmin\.com\/.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*UltraVNC_*_X86_Setup*",".{0,1000}UltraVNC_.{0,1000}_X86_Setup.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Universal.Virus.Sniffer.4.15.zip*",".{0,1000}Universal\.Virus\.Sniffer\.4\.15\.zip.{0,1000}","greyware_tool_keyword","Universal Virus Sniffer","Universal Virus Sniffer detect and remove malware - including rootkits but is also abused by attackers to disable antivirus","T1562 - T1055 - T1070","TA0005 - TA0004","N/A","Phobos","Defense Evasion","https://www.majorgeeks.com/files/details/universal_virus_sniffer.html","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*update.argotunnel.com*",".{0,1000}update\.argotunnel\.com.{0,1000}","greyware_tool_keyword","cloudflared","cloudfared Contains the command-line client for Cloudflare Tunnel - a tunneling daemon that proxies traffic from the Cloudflare network to your origins","T1572 - T1090 - T1071","TA0001 - TA0011","N/A","BlackSuit - Royal - Akira - Scattered Spider* - Gamaredon - TA4557 - FIN6","C2","https://github.com/cloudflare/cloudflared","1","1","N/A","N/A","10","10","9966","899","2025-02-27T11:21:46Z","2017-10-13T19:54:47Z"
"*update.remoteutilities.net*",".{0,1000}update\.remoteutilities\.net.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*update-check.softether-network.net*",".{0,1000}update\-check\.softether\-network\.net.{0,1000}","greyware_tool_keyword","SoftEtherVPN","Cross-platform multi-protocol VPN software abused by attackers","T1133 - T1210 - T1573 - T1219 - T1571","TA0001 - TA0002 - TA0003 - TA0005 - TA0010","N/A","GALLIUM","Defense Evasion","https://github.com/SoftEtherVPN/SoftEtherVPN","1","1","#VPN","N/A","8","10","12044","2628","2025-02-17T15:40:43Z","2014-01-02T12:40:57Z"
"*updog-master.zip*",".{0,1000}updog\-master\.zip.{0,1000}","greyware_tool_keyword","updog","Updog is a replacement for SimpleHTTPServer. It allows uploading and downloading via HTTP/S can set ad hoc SSL certificates and use http basic auth.","T1567 - T1074.001 - T1020","TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://github.com/sc0tfree/updog","1","1","N/A","N/A","9","10","3013","311","2024-03-13T15:52:39Z","2020-02-18T15:29:21Z"
"*upgrades.syncthing.net*",".{0,1000}upgrades\.syncthing\.net.{0,1000}","greyware_tool_keyword","syncthing","Open Source Continuous File Synchronization - abused by attackers for data exfiltration","T1046 - T1041 - T1020 - T1567","TA0043 - TA0007  - TA0010 ","N/A","Dispossessor - UAC-0020","Data Exfiltration","https://github.com/syncthing/syncthing","1","1","N/A","https://cert.gov.ua/article/6279600","9","10","67995","4412","2025-03-02T01:29:38Z","2013-11-26T09:48:21Z"
"*upload.box.com*",".{0,1000}upload\.box\.com.{0,1000}","greyware_tool_keyword","Box","Attackers have used box to store malicious files and then share them with targets - box can also be used for data exfiltration by attackers","T1567.002 - T1071.001 - T1036 - T1048.002","TA0005 - TA0010 - TA0009","N/A","N/A","Data Exfiltration","https://app.box.com/","1","1","#filehostingservice","N/A","9","7","N/A","N/A","N/A","N/A"
"*upload4.easyupload.io*",".{0,1000}upload4\.easyupload\.io.{0,1000}","greyware_tool_keyword","easyupload.io","file hosting platform abused by attackers to host malicious - url used when uploading a file on the site","T1567.002 - T1071.001 - T1041 - T1036.002","TA0010","N/A","Black Basta","Data Exfiltration","N/A","1","1","#filehostingservice","N/A","8","10","N/A","N/A","N/A","N/A"
"*use.rel.tunnels.api.visualstudio.com*",".{0,1000}use\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*use2.rel.tunnels.api.visualstudio.com*",".{0,1000}use2\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*usw2.rel.tunnels.api.visualstudio.com*",".{0,1000}usw2\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*usw3.rel.tunnels.api.visualstudio.com*",".{0,1000}usw3\.rel\.tunnels\.api\.visualstudio\.com.{0,1000}","greyware_tool_keyword","dev-tunnels","Dev tunnels allow developers to securely share local web services across the internet. Enabling you to connect your local development environment with cloud services and share work in progress with colleagues or aid in building webhooks","T1021.003 - T1105 - T1090","TA0002 - TA0005 - TA0011","N/A","N/A","C2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview","1","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"
"*uTorrent.exe*",".{0,1000}uTorrent\.exe.{0,1000}","greyware_tool_keyword","utorrent","popular BitTorrent client used for downloading files over the BitTorrent network. a peer-to-peer file sharing protocol. Can be used for collection and exfiltration. Not something we want to see installed in a enterprise network","T1193 - T1204 - T1486 - T1048","TA0005 - TA0011 - TA0010 - TA0040","N/A","N/A","Data Exfiltration","https[://]www[.]utorrent[.]com/intl/fr/","1","1","#P2P","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
"*utorrent_installer.exe*",".{0,1000}utorrent_installer\.exe.{0,1000}","greyware_tool_keyword","utorrent","popular BitTorrent client used for downloading files over the BitTorrent network. a peer-to-peer file sharing protocol. Can be used for collection and exfiltration. Not something we want to see installed in a enterprise network","T1193 - T1204 - T1486 - T1048","TA0005 - TA0011 - TA0010 - TA0040","N/A","N/A","Data Exfiltration","https[://]www[.]utorrent[.]com/intl/fr/","1","1","#P2P","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
"*utweb_installer.exe*",".{0,1000}utweb_installer\.exe.{0,1000}","greyware_tool_keyword","utorrent","popular BitTorrent client used for downloading files over the BitTorrent network. a peer-to-peer file sharing protocol. Can be used for collection and exfiltration. Not something we want to see installed in a enterprise network","T1193 - T1204 - T1486 - T1048","TA0005 - TA0009 - TA0011 - TA0010 - TA0040","N/A","N/A","Data Exfiltration","https[://]www[.]utorrent[.]com/intl/fr/","1","1","#P2P","N/A","N/A","N/A","N/A","N/A","N/A","N/A"
"*ValdikSS/dropbear-sshj*",".{0,1000}ValdikSS\/dropbear\-sshj.{0,1000}","greyware_tool_keyword","SSH-J.com","This is Dropbear SSH server modified to be used as a public SSH jump & port forwarding service","T1021 - T1090 - T1573 - T1219 - T1562.001","TA0001 - TA0005 - TA0008 - TA0011","N/A","N/A","C2","https://bitbucket.org/ValdikSS/dropbear-sshj/src/master/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*vaults.*.swi-rc.com*",".{0,1000}vaults\..{0,1000}\.swi\-rc\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*vsxrc-client.dll*",".{0,1000}vsxrc\-client\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*-web.screenconnect.com*",".{0,1000}\-web\.screenconnect\.com.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*web1.remotepc.com*",".{0,1000}web1\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*webhooksite/webhook.site*",".{0,1000}webhooksite\/webhook\.site.{0,1000}","greyware_tool_keyword","webhook.site","test HTTP webhooks with this handy tool that displays requests instantly - abused by attacker for payload callback confirmation","T1102 - T1071 - T1560.001","TA0011 - TA0042","N/A","N/A","C2","https://github.com/webhooksite/webhook.site","1","1","N/A","N/A","10","10","5694","441","2024-10-16T08:45:00Z","2016-03-21T08:45:42Z"
"*wget*.interact.sh*",".{0,1000}wget.{0,1000}\.interact\.sh.{0,1000}","greyware_tool_keyword","interactsh","Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external interactions but abused by attackers as C2","T1566.002 - T1566.001 - T1071 - T1102","TA0011 - TA0001","N/A","N/A","C2","https://github.com/projectdiscovery/interactsh","1","1","N/A","FP risk - legitimate service abused by attackers","10","10","3617","384","2025-02-27T09:39:18Z","2021-01-29T14:31:51Z"
"*whatsmyip.ccrmm.avg.com*",".{0,1000}whatsmyip\.ccrmm\.avg\.com.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*wildfoundry/dataplicity-agent*",".{0,1000}wildfoundry\/dataplicity\-agent.{0,1000}","greyware_tool_keyword","Dataplicity","enables connecting local systems to dataplicity cloud for remotely accessing them over the internet.","T1090 - T1102 - T1043 - T1071","TA0010 - TA0005 - TA0011","N/A","N/A","Data Exfiltration","https://github.com/wildfoundry/dataplicity-agent","1","1","N/A","N/A","9","2","167","32","2024-06-10T20:17:43Z","2016-07-27T14:23:01Z"
"*WindowsStoreAppExporter.exe*",".{0,1000}WindowsStoreAppExporter\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*WinRing0*WinRing0x64.sys*",".{0,1000}WinRing0.{0,1000}WinRing0x64\.sys.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*WireGuard/wireguard-go*",".{0,1000}WireGuard\/wireguard\-go.{0,1000}","greyware_tool_keyword","wiretap","Wiretap is a transparent - VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/sandialabs/wiretap","1","1","N/A","N/A","10","10","911","40","2024-11-26T00:33:13Z","2022-11-19T00:19:05Z"
"*Wireshark*",".{0,1000}Wireshark.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*wireshark*.deb*",".{0,1000}wireshark.{0,1000}\.deb.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*Wireshark*.dmg*",".{0,1000}Wireshark.{0,1000}\.dmg.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","#macos","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*wireshark-*.tar.xz*",".{0,1000}wireshark\-.{0,1000}\.tar\.xz.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*wireshark-common*",".{0,1000}wireshark\-common.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*wireshark-dev*",".{0,1000}wireshark\-dev.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*wireshark-gtk*",".{0,1000}wireshark\-gtk.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*WiresharkPortable64*",".{0,1000}WiresharkPortable64.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*wireshark-qt*",".{0,1000}wireshark\-qt.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*Wireshark-win*.exe*",".{0,1000}Wireshark\-win.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","wireshark","Wireshark is a network protocol analyzer.","T1040 - T1052.001 - T1046","TA0001 - TA0002 - TA0007","N/A","Black Basta","Sniffing & Spoofing","https://www.wireshark.org/","1","1","N/A","greyware tool - risks of False positive !","N/A","N/A","N/A","N/A","N/A","N/A"
"*wormhole.tunnelto.dev*",".{0,1000}wormhole\.tunnelto\.dev.{0,1000}","greyware_tool_keyword","tunnelto.dev","Expose your local web server to the internet with a public URL","T1572","TA0011 - TA0003","N/A","N/A","C2","https://github.com/agrinman/tunnelto","1","1","N/A","N/A","10","10","2152","116","2022-09-24T21:28:44Z","2020-03-22T05:39:49Z"
"*wss://meshcentral.com*",".{0,1000}wss\:\/\/meshcentral\.com.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*www.1secmail.com/api/v1/?action=*",".{0,1000}www\.1secmail\.com\/api\/v1\/\?action\=.{0,1000}","greyware_tool_keyword","1secmail.com","using the API of 1secmail (temporary email service) could be abused by malicious actors - observed in SafeBreach-Labs/DoubleDrive tool","T1071.003","TA0005 - TA0001","N/A","N/A","Defense Evasion","https://www.1secmail.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.ammyy.com/files/v*",".{0,1000}www\.ammyy\.com\/files\/v.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.anyplace-control.com/install*",".{0,1000}www\.anyplace\-control\.com\/install.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.autohotkey.com/download/*",".{0,1000}www\.autohotkey\.com\/download\/.{0,1000}","greyware_tool_keyword","AutoHotkey","AutoHotkey - macro-creation and automation-oriented scripting utility for Windows","T1056.001 - T1027 - T1059.001 - T1140","TA0005 - TA0002","N/A","N/A","Defense Evasion","https://github.com/AutoHotkey/AutoHotkey","1","1","N/A","abused by multiple threat actors https://thehackernews.com/2024/06/darkgate-malware-replaces-autoit-with.html - False positives expected","6","10","9869","983","2025-02-02T21:27:58Z","2009-11-25T11:08:21Z"
"*www.dwservice.net*",".{0,1000}www\.dwservice\.net.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Black Basta","RMM","https://github.com/dwservice/agent","1","1","N/A","N/A","10","5","458","83","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*www.ip-api.com*",".{0,1000}www\.ip\-api\.com.{0,1000}","greyware_tool_keyword","ip-api.com","get public ip address","T1016 - T1071.001","TA0005 - TA0002","N/A","Volt Typhoon","Reconnaissance","https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF","1","1","N/A","greyware_tools high risks of false positives","N/A","N/A","N/A","N/A","N/A","N/A"
"*www.ired.team*",".{0,1000}www\.ired\.team.{0,1000}","greyware_tool_keyword","ired.team","Red Teaming Tactics and Techniques","T1593.003","TA0043","N/A","N/A","Reconnaissance","https://github.com/mantvydasb/RedTeaming-Tactics-and-Techniques","1","1","N/A","N/A","7","10","4173","1068","2024-08-22T07:17:31Z","2019-03-02T13:33:33Z"
"*www.mediafire.com/api/1.5/upload/*",".{0,1000}www\.mediafire\.com\/api\/1\.5\/upload\/.{0,1000}","greyware_tool_keyword","mediafire","uploading to mediafire","T1105 - T1114","TA0010","N/A","Black Basta","Data Exfiltration","N/A","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.mediafire.com/file/*",".{0,1000}www\.mediafire\.com\/file\/.{0,1000}","greyware_tool_keyword","mediafire","downloading from mediafire","T1105 - T1114 - T1083","TA0009","N/A","Black Basta","Collection","N/A","1","1","#filehostingservice","N/A","7","8","N/A","N/A","N/A","N/A"
"*www.mediafire.com/file/*.rar/file*",".{0,1000}www\.mediafire\.com\/file\/.{0,1000}\.rar\/file.{0,1000}","greyware_tool_keyword","mediafire","downloading from mediafire - rar archive","T1105 - T1083 - T1560","TA0009 ","N/A","Black Basta","Collection","N/A","1","1","#filehostingservice","N/A","7","8","N/A","N/A","N/A","N/A"
"*www.mediafireuserupload.com/api/upload/*",".{0,1000}www\.mediafireuserupload\.com\/api\/upload\/.{0,1000}","greyware_tool_keyword","mediafire","uploading to mediafire","T1105 - T1114","TA0010","N/A","Black Basta","Data Exfiltration","N/A","1","1","#filehostingservice","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.pulseway.com/download/*",".{0,1000}www\.pulseway\.com\/download\/.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider* - Back Basta","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.splashtop.com/remotecaRemoveVRootsISCHECKFORPRODUCTUPDATES*",".{0,1000}www\.splashtop\.com\/remotecaRemoveVRootsISCHECKFORPRODUCTUPDATES.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.tightvnc.com/download/*=",".{0,1000}www\.tightvnc\.com\/download\/.{0,1000}\=","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www1.remotepc.com*",".{0,1000}www1\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*xeox.com/ui/download/*",".{0,1000}xeox\.com\/ui\/download\/.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*xmrig-*-bionic-x64.tar.gz*",".{0,1000}xmrig\-.{0,1000}\-bionic\-x64\.tar\.gz.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*xmrig-*-focal-x64.tar.gz*",".{0,1000}xmrig\-.{0,1000}\-focal\-x64\.tar\.gz.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*xmrig-*-freebsd-static-x64.tar.gz*",".{0,1000}xmrig\-.{0,1000}\-freebsd\-static\-x64\.tar\.gz.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*xmrig-*-gcc-win64.zip*",".{0,1000}xmrig\-.{0,1000}\-gcc\-win64\.zip.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*xmrig-*-linux-static-x64.tar.gz*",".{0,1000}xmrig\-.{0,1000}\-linux\-static\-x64\.tar\.gz.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","#linux","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*xmrig-*-linux-x64.tar.gz*",".{0,1000}xmrig\-.{0,1000}\-linux\-x64\.tar\.gz.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","#linux","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*xmrig-*-macos-arm64.tar.gz*",".{0,1000}xmrig\-.{0,1000}\-macos\-arm64\.tar\.gz.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*xmrig-*-macos-x64.tar.gz*",".{0,1000}xmrig\-.{0,1000}\-macos\-x64\.tar\.gz.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*xmrig-*-msvc-win64.zip*",".{0,1000}xmrig\-.{0,1000}\-msvc\-win64\.zip.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*xmrig.tar.gz*",".{0,1000}xmrig\.tar\.gz.{0,1000}","greyware_tool_keyword","xmrig","Auto setup scripts and pre-compiled xmr miner for c3pool.com pool","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*xmrig.zip*",".{0,1000}xmrig\.zip.{0,1000}","greyware_tool_keyword","xmrig","Auto setup scripts and pre-compiled xmr miner for c3pool.com pool","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*xmrminer.cc*",".{0,1000}xmrminer\.cc.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*xmrpool.de*",".{0,1000}xmrpool\.de.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*xmrpool.eu*",".{0,1000}xmrpool\.eu.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*xmrpool.eu:3333*",".{0,1000}xmrpool\.eu\:3333.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/xmrig/xmrig/","1","1","N/A","N/A","9","10","9087","3566","2024-12-23T16:14:22Z","2017-04-15T05:57:53Z"
"*xmrpool.me*",".{0,1000}xmrpool\.me.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*xmrpool.net*",".{0,1000}xmrpool\.net.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*xmrpool.xyz*",".{0,1000}xmrpool\.xyz.{0,1000}","greyware_tool_keyword","xmrig","CPU/GPU cryptominer often used by attackers on compromised machines","T1496 - T1057","TA0004 - TA0007","N/A","Pacha Group - APT4","Cryptomining","https://github.com/C3Pool/xmrig_setup/","1","1","N/A","N/A","9","1","27","21","2024-11-05T05:34:20Z","2020-05-16T13:01:30Z"
"*XWolfOverride/DuckDNS*",".{0,1000}XWolfOverride\/DuckDNS.{0,1000}","greyware_tool_keyword","duckdns.org","A simple C# DuckDNS updater - free dynamic DNS hosted on AWS - often used by threat actors for contacting C2","T1568.002 - T1071.001","TA0011 - TA0005","N/A","N/A","Defense Evasion","https://www.duckdns.org/install.jsp","1","1","N/A","N/A","5","10","N/A","N/A","N/A","N/A"
"*Yakit-*-windows-amd64.exe*",".{0,1000}Yakit\-.{0,1000}\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","yakit","security platform with fuzzers - webshell and MITM (chinese burp)","T1557 - T1557.003 - T1569.002","TA0001 - TA0040","N/A","N/A","Sniffing & Spoofing","https://github.com/Gerenios/AADInternals","1","1","N/A","N/A","7","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*Yakit/1.0.0*",".{0,1000}Yakit\/1\.0\.0.{0,1000}","greyware_tool_keyword","yakit","security platform with fuzzers - webshell and MITM (chinese burp)","T1557 - T1557.003 - T1569.002","TA0001 - TA0040","N/A","N/A","Sniffing & Spoofing","https://github.com/Gerenios/AADInternals","1","1","#useragent","user-agent","7","10","1372","224","2024-12-13T10:23:07Z","2018-10-25T17:35:16Z"
"*Ylianst/MeshAgent*",".{0,1000}Ylianst\/MeshAgent.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","1","N/A","N/A","10","3","250","94","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*Ylianst/MeshCentral*",".{0,1000}Ylianst\/MeshCentral.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4656","618","2025-02-27T18:35:15Z","2017-08-28T16:21:11Z"
"*zema1/suo5*",".{0,1000}zema1\/suo5.{0,1000}","greyware_tool_keyword","suo5","http proxy tunneling tool","T1071 - T1073 - T1075 - T1105 - T1571","TA0008 - TA0011","N/A","N/A","C2","https://github.com/zema1/suo5","1","1","N/A","N/A","10","10","2270","209","2025-02-20T05:10:49Z","2022-11-22T11:45:26Z"
"*ZeroLogonScanner.*",".{0,1000}ZeroLogonScanner\..{0,1000}","greyware_tool_keyword","pingcastle","active directory weakness scan Vulnerability scanner and Earth Lusca Operations Tools and commands","T1016 - T1069.002 - T1087.002 - T1485","TA0007 - TA0008","N/A","MAZE - BianLian - Scattered Spider* - DragonForce","Vulnerability Scanner","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf https://github.com/vletoux/pingcastle","1","1","N/A","N/A","10","","N/A","","",""
"*ZohoMeeting.exe*",".{0,1000}ZohoMeeting\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"https://*.xyz/*.ps1","http.*\.(country|stream|gdn|mom|xin|kim|men|loan|download|racing|online|science|ren|gb|win|top|review|vip|party|tech|xyz|date|faith|cricket|space|info|vn|cm|am|cc|asia|ws|tk|biz|su|st|ge|pk|nu|me|ph|to|tt|name|tv|kz|tc|mobi|study|click|link|trade|accountant|cf|gq|ml|ga|pw)\/.*\.(exe|vbs|bat|rar|ps1|doc|docm|xls|xlsm|pptm|rtf|hta|dll|ws|wsf|sct|zip|bin)$","greyware_tool_keyword","_","Suspicious tlds with suspicious file types","T1204 - T1212 - T1562","TA0001 - TA0003 - TA0005","N/A","N/A","Phishing","N/A","0","1","N/A","N/A","8","10","N/A","N/A","N/A","N/A"