Maintained products
Current supported software, led by AdversaryGraph and its associated public Threat Matrix workspace.
Canonical Public Footprint
1200km projects, packages, research, and external submissions.
This page is the public index for the 1200km security research ecosystem: flagship CTI platforms, malware-analysis tooling, PyPI packages, Docusaurus field guides, Medium research, labs, and community submission status.
Portfolio Map
Lifecycle-aware catalogueResearch projects
Question-led CTI and detection work with methods, evidence, findings, and stated limitations.
Reusable packages
Installable utilities with registry and source links; availability is not presented as adoption.
Labs
Reproducible training and validation environments, separated from maintained product claims.
AI Security course
CTI-led, lab-intensive practitioner curriculum covering complete AI systems, adversarial ML, agents, detection, and DFIR. Currently under construction.
Community contributions
Accepted upstream work is separated from open submissions and backed by public records.
Archive
Superseded names, older version-specific material, and archived repositories remain available with lifecycle context.
Review Path
Fastest route1. AdversaryGraph
Primary flagship: CTI-to-detection workbench, actor/TTP library, ATT&CK comparison, IOC investigation, MalwareGraph-backed malware analysis, hunting guidance, and report workflow.
Documented source release: v7.0.0, merged and CI-validated on main. It includes governed hybrid retrieval across 12 platform source types, business-profile scoping, citation-grounded answers, persisted expiring Navigator advisory proposals that require analyst confirmation but do not save a layer, and a fixed four-tool stdio MCP surface. Exact matching and PostgreSQL full-text search are the default; private pgvector embeddings are optional. Published boundary: v8.1.2 is the latest GitHub release, matching the documented source release.
2. AIDebug
Evidence-first malware reverse-engineering environment with PE and ELF triage, occurrence-aware String Intelligence, disassembly, control flow, Ghidra reconstruction, optional AI review, ATT&CK candidates, YARA seeds, local history, and JSON/HTML reports.
3. CTI as a Code
Version-controlled CTI methodology and training lab with OpenCTI, TheHive, Elastic SIEM, evidence registers, and detection outputs.
4. Operation Desert Hydra
MuddyWater CTI-to-detection pipeline with OpenCTI graph, detection atlas, Kibana validation, and reproducible lab evidence.
Product Names and Lifecycle
Verified 2026-07-21Maintained
AdversaryGraph is the flagship self-hosted platform. Threat Matrix is its associated public, read-only browser ATT&CK workspace, not the full platform.
Superseded names
ThreatMapper is the historical name replaced by AdversaryGraph. AdversaryGraph Web is a superseded alias for Threat Matrix. Redirects and explicitly historical articles preserve old URLs.
Archived repositories
GitHub currently marks lpi, Malware_analysis, Networking, and SystemCheck as archived. They are not presented as maintained products.
Definitions and source links are maintained in the authoritative fact model; content identity, lifecycle, and taxonomy are maintained in the content catalogue. Labs and research demonstrations are not automatically classified as products.
Package Tools and Publication Status
PyPI verified 2026-07-21| Package | Availability | Purpose | Links |
|---|---|---|---|
| AIDebug | pip install 1200km-aidebug |
Malware debugger and reverse-engineering assistant. | PyPI · Repo |
| AuditAI | pip install 1200km-auditai |
Linux host vulnerability assessment with optional AI analysis. | PyPI · Repo |
| String Analyzer | pip install string-analyzer |
Extract strings, URLs, IPs, registry keys, APIs, and analyst prompts from binaries. | PyPI · Repo |
| Unpacker | Not published to PyPI | Packer detection and unpacking workflow for malware triage. | Source repository |
| PE Import Analyzer | Not published to PyPI | PE import-table capability triage for malware analysts. | Source repository |
| FileInfo | Not published to PyPI | First-pass file metadata, hashes, strings, entropy, YARA, and static triage. | Source repository |
Project Inventory
Public non-fork reposCTI & Detection
AdversaryGraph, CTI Analyst Field Manual, CTI as a Code, Operation Desert Hydra, Israel Government Threat Actors CTI, CTI Detection Pack, threat-hunting hypotheses.
ATT&CKOpenCTISigma/YARAhunting
Malware & Reverse Engineering
AIDebug, String Analyzer, Unpacker, PE Import Analyzer, Android Malware Analysis, Static Malware Analysis Orchestrator, Basic File Information Gathering Script.
malware triageYARAIOCPyPI
AI Security & Offensive Labs
HexStrike AI Guide, AI Offensive research, AI-PT-Lab, StratusAI, Vulnerable Cloud Lab, Vulnerable APK, DragonRx Lab, RTSP and password tooling.
authorized labsMCPcloudAD
Professional & Portfolio
Main site, start-here, local Article Archive, CV, About, project landing pages, and reading paths for different reviewer roles.
portfolioreading pathsGitHub profile
External Submission Status
Community discovery| Project | Status | Submitted To | Links |
|---|---|---|---|
| AdversaryGraph | Accepted | awesome-soc, awesome-gpt-security, awesome-cyber-security | awesome-soc #20 · awesome-gpt-security #50 · awesome-cyber-security #30 |
| AIDebug | Partially accepted | Accepted by awesome-yara and REMnux salt-states (merged 2026-10-07; released in v2026.41.4); BlackArch request and Kali new-tool request open | awesome-yara #78 · REMnux PR #355 · BlackArch #4965 · Kali #9743 |
| AuditAI | Submitted | Kali Linux new-tool request (status “new”) | Kali #9745 |
| String Analyzer | Submitted | Kali Linux new-tool request (status “new”) | Kali #9744 |
| StratusAI | Prepared | Kali request text prepared, not yet filed | Request text · Tracker |
| CTI Field Manual / ThreatMapper / Detections | Partially accepted | Accepted by awesome-detection-engineering and MISP Galaxy; SigmaHQ rules open | awesome-detection-engineering #28 · MISP Galaxy #1227 · SigmaHQ #6065 |
| OpenCTI connector | Submitted | OpenCTI connectors (Anthropic AI enrichment) | PR #6819 |
| HexStrike Guide | Submitted | Official HexStrike AI repository | PR #187 |
| Lab Portfolio | Partially accepted | Accepted by awesome-vulnerable-apps and awesome-cyber-security; LLM-security list open | awesome-vulnerable-apps #44 · awesome-cyber-security #27 · awesome-llm-security #226 |
REMnux acceptance checked 2026-10-08; other request statuses checked 2026-10-04 against GitHub, GitLab and the Kali bug tracker. Submissions with no maintainer response were withdrawn on 2026-08-05 and are no longer listed. Items stay marked as submitted until an upstream maintainer merges, accepts, or explicitly rejects the contribution. Full evidence: External Validation.
Article Clusters
Medium and InfoSec Write-upsCTI-to-Detection
AdversaryGraph, CTI as a Code, Customer-Driven AI CTI, attribution methodology, ATT&CK usage, infrastructure pivoting, malware-to-CTI pivots, and detection handoff.
Malware Analysis
Historical AdversaryGraph v4 Malware Analysis coverage, the current Malware Analysis workflow, MalwareGraph standalone work, AIDebug, Android APK triage, strings, PE imports, unpacking, static orchestrator workflows, and YARA/IOC-ready analyst outputs.
AI Offensive Security
HexStrike MCP, Cursor, Gemini, OpenAI Codex, local Ollama workflows, controlled labs, and defender takeaways.
Cloud, Identity, and Anomaly
StratusAI, vulnerable cloud labs, Kubernetes security, ITDR, UEBA, insider threat, anomaly detection, and CVSS prioritization.
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Attack Simulations — Dedicated ecosystem module
- Attack Tools — Dedicated ecosystem module
- Detection Rules — Dedicated ecosystem module
Anomaly Detection Atlas
Start with password spraying, SaaS downloads, or the Kerberoasting zero-match. Follow the unified research from statistical-signal foundations and documented incidents to operational anomaly families, measurable models, collection contracts, and validation limits. The visual index connects all 55 current figures to their evidence and text equivalents.
Use these references alongside the Detection Rules, Telemetry Library, and Attack Simulations modules. Source evidence and documented procedures do not establish production detector performance.