Skip to content

Conversation

@akshayjain-1
Copy link

@akshayjain-1 akshayjain-1 commented Jan 2, 2026

Summary
This PR adds a new warning list for Windows binary hashes using data from the winbindex project. This helps prevent false positives when Windows system file hashes are flagged in threat intelligence feeds.

Changes

  • Added generate-windows-binary-hashes.py generator script
  • Generates list.json with SHA256 hashes of known Windows binaries

In threat intelligence and incident response, file hashes (particularly SHA256) are commonly used as Indicators of Compromise (IoCs). However, legitimate Windows system files frequently appear in threat feeds, causing false positives that waste analyst time and reduce trust in automated detections.

The winbindex project by m417z is a comprehensive, continuously updated database that tracks Windows binaries across all major Windows versions and builds.

By implementing this warning list, organizations using MISP for threat intelligence can significantly improve their signal-to-noise ratio, making their security operations more efficient and effective.

@adulau would love to hear your thoughts and feedback on this!

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import json

Check notice

Code scanning / CodeQL

Unused import Note

Import of 'json' is not used.
@adulau
Copy link
Member

adulau commented Jan 2, 2026

Thanks a lot. This looks like a great idea and contribution. I'll review it. I'm curious about the matches between this dataset and hashlookup.io ;-)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants