CyberHawk Threat Intel is more than a threat intelligence platform — it's a full analyst workbench. Under the Resources section, you'll find 20 live tools across four categories: Blue Team, Incident Response, OSINT, and Security Operations. No sign-up walls. No paid tiers blocking critical functionality. Just tools that work the way analysts actually work. This guide walks you through every single one — what it does, how to use it, and what you'll get out of it.
◈ Table of Contents
Blue Team
1 TOOLInstantly break down any IP address in CIDR notation into its full network details — network address, broadcast address, subnet mask, usable host range, and total host count. Essential for firewall rule writing, network segmentation planning, and validating IP ranges during incident response.
◈ How to Use
- 1Navigate to Resources → Blue Team → CIDR / Subnet Calculator
- 2Enter an IP address with CIDR prefix — e.g.
192.168.10.0/24or10.0.0.0/8 - 3Click Calculate — results render instantly below the input
- 4Review the full breakdown including all subnettable ranges if you need to split further
- 5Copy the output directly into your firewall rules, ACL entries, or incident report
◉ Output You'll Get
- Network address and broadcast address
- Subnet mask in dotted decimal and binary
- First and last usable host IP
- Total number of usable hosts
- Wildcard mask for ACL configurations
- CIDR class identification (A / B / C)
When blocking a malicious ASN or C2 IP range, paste the CIDR block here first to confirm scope before pushing to your firewall — avoids accidentally blocking legitimate IPs in overlapping ranges.
Incident Response
10 TOOLSPaste raw log data from any source — Windows Event Logs, Syslog, Apache/Nginx access logs, firewall logs, or authentication logs — and the Log Investigator parses, highlights, and surfaces suspicious patterns. It detects failed login attempts, privilege escalation events, suspicious process execution, unusual network connections and more — all colour-coded for rapid triage.
◈ How to Use
- 1Open Log Investigator from the Incident Response tools section
- 2Paste your raw log data into the input panel — supports any plain text log format
- 3Select the log type if prompted (Windows Event, Syslog, Web Access, Firewall)
- 4Click Investigate — the tool parses every line and flags anomalies
- 5Review highlighted entries — red for critical, orange for suspicious, yellow for informational
- 6Use the filter bar to isolate by event type, IP, username, or keyword
- 7Export flagged lines for your incident report
◉ Output You'll Get
- Colour-coded log entries by severity
- Detected event patterns (brute force, recon, exfil indicators)
- Timeline of suspicious activity
- Unique IPs, usernames and hostnames extracted
- Filterable and searchable parsed output
Copy Windows Event Log exports directly from Event Viewer as text and paste — the investigator handles raw XML event log format too.
Build custom Velociraptor VQL artifacts without writing raw VQL from scratch. Select your collection targets — registry keys, file paths, running processes, network connections, event logs — and the builder generates a ready-to-deploy artifact YAML file. Perfect for rapid response collections during live incidents.
◈ How to Use
- 1Open Velociraptor Artifact Builder from Incident Response tools
- 2Enter your artifact name and description — this becomes the artifact metadata
- 3Select collection targets: file system paths, registry keys, processes, network, event logs
- 4Configure parameters — file extensions to target, path depth, time range filters
- 5Click Generate Artifact to produce the YAML output
- 6Copy the YAML and import directly into your Velociraptor server via the Artifact Editor
- 7Deploy the artifact to target endpoints for collection
◉ Output You'll Get
- Production-ready Velociraptor artifact YAML
- VQL queries pre-configured for your selected targets
- Parameterised inputs for flexible deployment
- Compatible with Velociraptor 0.6.x and above
Build persistence-hunting artifacts by targeting common autorun registry keys (Run, RunOnce, Services) combined with recently modified files in temp directories — this combination catches most malware installation patterns.
Microsoft 365 Unified Audit Log (UAL) exports are notoriously difficult to read raw. This tool takes your UAL CSV export and transforms it into a structured, filterable, colour-coded investigation view. Identify suspicious mailbox access, OAuth app consent, external sharing events, admin privilege changes and more — critical for M365 compromise investigations.
◈ How to Use
- 1Export your UAL from Microsoft Purview Compliance Portal → Audit → Search as CSV
- 2Open UAL Analyser and paste or upload your CSV export
- 3The tool parses the AuditData JSON column and flattens all nested fields
- 4Filter by operation type —
MailboxLogin,FileDownloaded,Add-MailboxPermission, etc. - 5Sort by timestamp to build a chronological activity timeline
- 6Identify anomalous IPs, unusual access times, and suspicious operation chains
- 7Export filtered results for your M365 incident report
◉ Output You'll Get
- Flattened, readable audit event table
- Highlighted high-risk operations (mailbox delegation, forwarding rules)
- Unique user and IP pivot table
- Timeline view of suspicious activity chains
- BEC-pattern detection flags
When investigating a Business Email Compromise, filter for Set-InboxRule and UpdateInboxRules operations first — attackers almost always create forwarding rules immediately after gaining access.
Decode percent-encoded URLs, resolve shortened links, and expand redirect chains without clicking anything. Analysts frequently encounter obfuscated or shortened URLs in phishing emails and malware — this tool safely reveals the true destination and decodes all encoding layers without your browser ever touching the URL.
◈ How to Use
- 1Open URL Decoder / Expander from Incident Response tools
- 2Paste the encoded or shortened URL into the input — e.g.
hxxps://bit[.]ly/abc123 - 3Select decode mode: URL Decode (percent encoding), Expand (follow redirects), or Both
- 4Click Decode / Expand — the tool resolves the chain server-side, safely
- 5Review each hop in the redirect chain and the final destination URL
- 6Copy the defanged final URL for your report or feed it into the IOC Scanner
◉ Output You'll Get
- Fully decoded URL with all encoding layers stripped
- Complete redirect chain with each hop listed
- Final destination URL (true landing page)
- HTTP status codes for each redirect hop
- Defanged output ready for safe sharing
Always paste defanged URLs (with [.] replacing dots) — the tool automatically refangs them for processing so you never accidentally click a live malicious link.
Paste any block of unstructured text — a threat report PDF, a SIEM alert email, a malware analysis write-up, a Pastebin dump — and the IOC Extractor automatically identifies and extracts every indicator of compromise embedded in the text. IPs, domains, URLs, MD5/SHA1/SHA256 hashes, email addresses, CVE IDs, and MITRE ATT&CK technique IDs all get pulled out and sorted into clean, copyable lists.
◈ How to Use
- 1Open IOC Extractor from Incident Response tools
- 2Paste your raw text — can be a full threat report, alert body, email content, or dump
- 3Click Extract IOCs — the tool scans the full text with regex pattern matching
- 4Review the categorised results: IPs, Domains, URLs, Hashes, Emails, CVEs, MITRE IDs
- 5Deselect any false positives before copying
- 6Copy per-category lists for importing into your SIEM, MISP, or threat intel platform
- 7Feed extracted IPs and domains directly into the IOC Scanner for enrichment
◉ Output You'll Get
- Extracted IPs (IPv4 and IPv6)
- Domains and hostnames
- Full URLs
- MD5, SHA1, SHA256 file hashes
- Email addresses
- CVE identifiers
- MITRE ATT&CK technique IDs
Paste the full body of a vendor threat advisory or CISA alert — the extractor will pull every IOC in seconds, saving hours of manual copy-paste across a 20-page PDF.
Safely share threat intelligence by defanging IOCs — replacing dots with [.],
HTTP with hxxp, and at-signs with [at] so links and addresses
can't be accidentally clicked or resolved. Refang in the opposite direction when you need to
process defanged IOCs for live analysis. Bulk process entire lists in one operation.
◈ How to Use
- 1Open IOC Defanger / Refanger from Incident Response tools
- 2Paste your IOCs — one per line, or as a block of text containing mixed indicators
- 3Choose mode: Defang (for safe sharing) or Refang (for analysis)
- 4Click Convert — all indicators are processed simultaneously
- 5Copy the output and paste directly into your report, Slack, email, or MISP
◉ Output You'll Get
- Defanged:
hxxps://malware[.]example[.]com/payload - Defanged:
192[.]168[.]1[.]1 - Defanged:
attacker[at]evil[.]com - Refanged output for live processing
- Bulk converted list — all indicators at once
Use defanging as a standard practice before pasting any IOC into a Jira ticket, Confluence page, or email thread — many platforms auto-hyperlink URLs which can lead to accidental clicks by non-technical stakeholders.
Generate cryptographic hashes of any text string or file content — MD5, SHA1, SHA256, SHA512. Useful for creating file integrity baselines, verifying downloads, generating IOC hashes from known-bad strings, and quickly producing hash values for evidence documentation during incident response.
◈ How to Use
- 1Open Hash Generator from Incident Response tools
- 2Choose input type: Text (paste a string) or File (upload a file)
- 3Enter your text or upload your file
- 4Select which algorithms to compute: MD5, SHA1, SHA256, SHA512 (or all simultaneously)
- 5Click Generate — all selected hashes compute instantly
- 6Copy individual hash values or the full result block for your documentation
◉ Output You'll Get
- MD5 hash (128-bit)
- SHA1 hash (160-bit)
- SHA256 hash (256-bit) — most common for malware IOCs
- SHA512 hash (512-bit)
- All computed client-side — file content never leaves your browser
For incident evidence preservation, always generate both SHA256 and MD5 of collected artefacts — SHA256 for integrity proof, MD5 for legacy tool compatibility. Document both in your chain of custody.
Attackers almost always obfuscate their PowerShell payloads using Base64 encoding, string concatenation, character substitution, and nested IEX calls. This tool layers multiple deobfuscation passes to reveal the true command underneath — without needing to execute anything. Essential for analysing living-off-the-land attacks, fileless malware, and PowerShell-based C2 stagers.
◈ How to Use
- 1Open PowerShell Deobfuscator from Incident Response tools
- 2Paste your obfuscated PowerShell — from a SIEM alert, EDR detection, or log entry
- 3Click Deobfuscate — the tool runs multiple decoding passes automatically
- 4Review each layer of decoding shown in sequential steps
- 5The final output shows the true readable command or payload
- 6Extract any embedded URLs, IPs or commands for further IOC Scanner enrichment
◉ Output You'll Get
- Decoded Base64 layers revealed step-by-step
- String concatenation resolved to readable text
- IEX (Invoke-Expression) chains unwrapped
- Final plain-text command or download cradle
- Embedded URLs and IPs highlighted for extraction
If the deobfuscated output contains a download cradle like IEX (New-Object Net.WebClient).DownloadString('http://...') — extract that URL and immediately run it through the IOC Scanner and URL Decoder to identify the C2 or payload stage.
IDN homograph attacks use visually identical Unicode characters to impersonate legitimate
domains — for example аpple.com (Cyrillic 'а') vs apple.com (Latin 'a').
This tool converts between Unicode and Punycode representations to reveal the true identity of
suspicious domains, detect homograph phishing domains, and validate whether a domain is truly
what it appears to be.
◈ How to Use
- 1Open Unicode / Punycode Converter from Incident Response tools
- 2Paste the suspicious domain name into the input field
- 3Select conversion direction: Unicode → Punycode or Punycode → Unicode
- 4Click Convert — the Punycode representation is revealed (e.g.
xn--pple-43d.com) - 5If Punycode differs from expected, the domain contains non-ASCII characters — flag as homograph attack
- 6Submit the Punycode domain to the IOC Scanner for threat intel enrichment
◉ Output You'll Get
- Punycode (ACE) representation of the domain
- Unicode decoded version of Punycode input
- Character-by-character breakdown flagging non-ASCII chars
- Homograph risk indicator
Always run domain names from phishing emails through this converter before analysing — many advanced phishing kits use Cyrillic or Greek Unicode characters that are visually identical to Latin characters in most fonts.
Base64 encoding is the most common obfuscation layer used in malware, phishing payloads, and web shells. This tool decodes Base64 strings, handles multi-layer encoding, detects URL-safe Base64 variants, and identifies what type of payload is hidden inside — executable, script, URL, or command — without executing anything.
◈ How to Use
- 1Open Base64 Payload Analyser from Incident Response tools
- 2Paste the Base64 string — from a log, script, email attachment, or web shell
- 3Click Decode & Analyse — the tool decodes and inspects the output
- 4If the decoded output is itself Base64 encoded, click Decode Again to peel the next layer
- 5Review the payload type classification and any embedded IOCs
- 6Extract URLs, IPs, or commands from the decoded output for further analysis
◉ Output You'll Get
- Decoded plain-text or binary content
- Payload type identification (script, EXE, URL, command)
- Multi-layer decoding with each layer shown
- Embedded IOCs highlighted (IPs, URLs, commands)
- Hex view for binary payloads
PowerShell commands encoded with -EncodedCommand flag use UTF-16LE Base64 — the analyser handles this variant automatically, which standard decoders often break on.
OSINT
7 TOOLSSearch the full NVD (National Vulnerability Database) by CVE ID, keyword, product name, or vendor — and get the complete vulnerability profile including CVSS v3 scores, attack vector, affected versions, exploit availability, patch status, and linked CWE categories. Cross-references with CISA KEV (Known Exploited Vulnerabilities) to flag actively exploited CVEs.
◈ How to Use
- 1Open CVE Lookup from OSINT tools
- 2Enter a CVE ID (e.g.
CVE-2024-21413), product name (e.g.Microsoft Outlook), or keyword - 3Click Search — results pull from NVD and CISA KEV in real time
- 4Review the CVSS score, attack vector, complexity, and privileges required
- 5Check the CISA KEV badge — if present, this CVE is actively exploited in the wild
- 6Review affected software versions and apply linked patch references
◉ Output You'll Get
- Full CVE description and affected products
- CVSS v3 base score with severity rating
- Attack vector, complexity, privileges, and user interaction requirements
- CISA KEV status — actively exploited flag
- CWE weakness category
- Patch and reference links
During incident response, always check if the CVE associated with the initial access vector is on the CISA KEV list — if it is, there's a high chance other threat actors are also targeting the same vulnerability in your environment.
Living Off the Land Binaries, Scripts and Libraries (LOLBAS) are legitimate Windows system tools that attackers abuse to execute code, download payloads, and evade detection. This browser lets you search and explore the full LOLBAS catalogue — every binary, script and library with its documented abuse techniques, command examples, and detection guidance.
◈ How to Use
- 1Open LOLBAS Browser from OSINT tools
- 2Search by binary name (e.g.
certutil,mshta,regsvr32) or technique (e.g.download,execute) - 3Click any result to see the full abuse profile for that binary
- 4Review documented abuse commands with real-world examples
- 5Use the detection guidance section to build SIEM rules or EDR exclusions
- 6Filter by function type: Download, Execute, Compile, Encode, UAC Bypass
◉ Output You'll Get
- Full catalogue of Windows LOLBins with abuse commands
- MITRE ATT&CK technique mappings per binary
- Real-world attacker command examples
- Detection and hunting guidance per entry
- Function classification (download, execute, bypass)
When you see an unusual certutil.exe or bitsadmin.exe process in your EDR, look them up here first — these are among the most abused LOLBins for payload download and will show you exactly what command patterns to hunt for.
Generate targeted Google Dork queries for OSINT investigations, attack surface enumeration, and passive reconnaissance. Select your target (domain, organisation, person, file type) and the type of information you're hunting — exposed credentials, open directories, login portals, sensitive documents, misconfigured devices — and get a ready-to-run Google dork query.
◈ How to Use
- 1Open Google Dorks Generator from OSINT tools
- 2Enter your target domain or organisation name
- 3Select the dork category: Exposed Files, Login Portals, Credentials, Config Files, Open Directories
- 4Click Generate Dorks — a set of targeted queries is produced
- 5Click any dork query to open it directly in Google search
- 6Review results for exposed sensitive data and document findings
◉ Output You'll Get
- Targeted dork queries for your domain/org
- Category-specific queries (files, portals, credentials)
- One-click Google search links
- Explanation of what each dork is designed to find
Use dork generation as part of your threat exposure assessment before a red team engagement — finding your own exposed admin panels and config files before an attacker does is exactly what this is built for.
Images shared online often contain hidden EXIF metadata that reveals GPS coordinates, device make and model, software version, timestamps, and author information. This tool extracts all embedded metadata from any image file — JPEG, PNG, TIFF — without uploading it to any external server. Invaluable for geolocation OSINT, threat actor tracking, and digital forensics.
◈ How to Use
- 1Open Image Metadata Extractor from OSINT tools
- 2Upload the image file (JPEG, PNG, TIFF) — processing happens entirely in your browser
- 3Click Extract Metadata — all EXIF fields are parsed and displayed
- 4If GPS coordinates are present, click View on Map to see the exact location
- 5Review device, software, and timestamp fields for investigative context
- 6Export the metadata table for inclusion in your OSINT report
◉ Output You'll Get
- GPS coordinates with map link (if embedded)
- Camera make, model and lens information
- Date and time of capture (device local time)
- Software used to edit or create the image
- Author / copyright fields
- Image dimensions, resolution and colour profile
When investigating threat actor personas, any images they post on social media or forums may contain GPS data revealing physical location — even screenshots sometimes carry metadata from screen capture software.
Attackers register typosquatted domains — slight misspellings of legitimate brands — to intercept traffic, conduct phishing, and distribute malware. This tool generates all plausible typosquat variations of any domain: character transpositions, missing letters, added letters, homoglyphs, TLD swaps, and hyphenation variations. Use it to protect your brand or investigate suspicious lookalike domains.
◈ How to Use
- 1Open Typosquat Generator from OSINT tools
- 2Enter the target domain — e.g.
cyberhawkthreatintel.com - 3Click Generate Variants — all plausible variations are computed
- 4Review the full list of generated typosquat domains grouped by technique
- 5Check generated domains against WHOIS to identify which ones are already registered
- 6Feed suspicious registered variants into the IOC Scanner for threat intel checks
◉ Output You'll Get
- Character transposition variants
- Missing and extra character variants
- Homoglyph substitution variants
- TLD swap variants (.net, .org, .co, etc.)
- Hyphenated and combined variants
- Full list — copyable for bulk WHOIS checking
Run your organisation's primary domain through this generator quarterly and check the WHOIS on all registered variants — catching a typosquat before it gets weaponised gives you time to report and take it down proactively.
JSON Web Tokens (JWTs) are used across modern web applications for authentication and authorisation. This tool decodes any JWT instantly — revealing the header algorithm, all payload claims, expiry time, issued-at timestamp, and subject identity — without requiring the signing secret. Essential for web app pen testing, API security reviews, and forensic analysis of intercepted tokens.
◈ How to Use
- 1Open JWT Decoder from OSINT tools
- 2Paste the full JWT token (the three-part
xxxxx.yyyyy.zzzzzstring) - 3Click Decode — header and payload are decoded and formatted instantly
- 4Review the Header section: algorithm type (HS256, RS256, none — flag
alg:noneas critical) - 5Review the Payload section: user identity, roles, expiry (
exp), issued at (iat) - 6Check if the token is expired, and note any sensitive claims like admin roles or elevated permissions
◉ Output You'll Get
- Decoded header with algorithm and token type
- All payload claims in formatted JSON
- Expiry status (valid / expired / no expiry)
- Issued-at and not-before timestamps
- Subject, issuer and audience fields
- Algorithm weakness flags (alg:none, weak HS256)
Always check for "alg": "none" in the header — this is a known JWT vulnerability that bypasses signature verification entirely. Any application accepting tokens with this algorithm is critically misconfigured.
Email headers contain the full routing history of a message — every server hop, timestamp, and authentication result. This tool parses raw email headers and presents them as a structured, readable analysis — tracing the true origin IP, detecting spoofed sender addresses, validating SPF/DKIM/DMARC results, and building a complete delivery timeline. Critical for phishing investigations and BEC analysis.
◈ How to Use
- 1In your email client, open the suspicious email and view raw/original headers (varies by client)
- 2Copy the full raw header block
- 3Open Email Header Analyser from OSINT tools and paste the headers
- 4Click Analyse — all header fields are parsed and the delivery chain is mapped
- 5Review the originating IP — this is the true sender IP, not the display name
- 6Check SPF, DKIM and DMARC results — fail or softfail = spoofing indicator
- 7Feed the originating IP into the IOC Scanner for reputation check
◉ Output You'll Get
- Full delivery hop chain with timestamps per hop
- True originating IP address
- SPF, DKIM and DMARC authentication results
- Sender vs Reply-To mismatch detection
- Mail server geolocation per hop
- Spoofing and phishing risk indicators
- Total delivery time across all hops
The Received: headers are read bottom-up — the bottom-most entry is where the email originated. The top entry is the final delivery to your mail server. Always start from the bottom when tracing the true source.
Security Operations
2 TOOLSIOC Hunt is a bulk threat hunting tool — paste a list of IPs, domains, hashes, or URLs and cross-reference the entire list against the CyberHawk live threat database simultaneously. Built for SOC analysts who need to triage large IOC sets from threat reports, SIEM alerts, or incident exports without manually checking each one individually. Get a pass/fail verdict for every indicator in seconds.
◈ How to Use
- 1Open IOC Hunt from Security Operations tools
- 2Paste your IOC list — one indicator per line, mixed types accepted (IPs, domains, hashes, URLs)
- 3The tool auto-classifies each indicator by type before scanning
- 4Click Hunt — all indicators are checked against the CyberHawk threat database in parallel
- 5Review the results table — each IOC gets a MATCH, CLEAN, or UNKNOWN verdict
- 6Click any matched IOC to see the full threat record — severity, first seen, last seen, campaign tags
- 7Export matched results for your SOC ticket or incident report
◉ Output You'll Get
- Per-IOC verdict: MATCH / CLEAN / UNKNOWN
- Threat severity for each matched IOC
- First seen and last seen dates
- Associated threat campaign or malware family
- IOC type classification for every indicator
- Exportable matched results table
- Summary stats: X matched of Y total checked
When you receive a threat intel report with 50+ IOCs, run the entire list through IOC Hunt first — this immediately separates confirmed malicious indicators from unknowns, so you focus investigation time on what's actually in the database rather than manually checking each one.
A full end-to-end phishing email investigation tool. Paste the raw email content — headers, body, and links — and the Phishing Analyser scores it against known phishing patterns, extracts and checks all embedded URLs, validates sender authentication, flags social engineering indicators, and produces a complete phishing verdict with evidence. Designed to turn a 30-minute phishing triage into a 60-second analysis.
◈ How to Use
- 1Open Phishing Analyser from Security Operations tools
- 2Paste the full raw email content — include headers, subject, body, and any embedded links
- 3Click Analyse — the tool processes every element of the email simultaneously
- 4Review the Phishing Score (0–100) and overall verdict at the top of the results
- 5Expand the URL Analysis section — every link is extracted, decoded, and checked
- 6Review the Social Engineering Indicators section — urgency language, impersonation, pretexting patterns flagged
- 7Check the Sender Analysis — SPF/DKIM/DMARC results and display name vs actual sender mismatch
- 8Export the full analysis report for your security ticket or user awareness training
◉ Output You'll Get
- Overall phishing verdict and confidence score (0–100)
- All URLs extracted, decoded and threat-checked
- Sender authentication results (SPF / DKIM / DMARC)
- Display name spoofing and lookalike domain detection
- Social engineering language indicators flagged
- Credential harvesting page detection
- Attachment type risk assessment
- Full exportable analysis report
When a user reports a suspected phishing email, copy the full raw message source (not just the visible content) and paste it here — the hidden headers and encoded URLs in the raw source reveal far more than what is visible in the email client preview.
All 20 tools are live, free, and built for real analyst workflows. No paywalls. No installs. No sign-up required for most tools. Every tool runs in your browser and is purpose-built around how actual SOC analysts, threat hunters and incident responders work.
Registered users get additional benefits — scan history, CyberHawk proprietary database matching, priority enrichment, and access to the full threat intelligence platform.
◈ Stay Connected
Follow CyberHawk Threat Intel for daily threat intelligence, tool drops, and cybersecurity content across all platforms.
"They can't exploit you if you are the Exploit."