Building a Threat Intel CLI Tool in Rust

Wed, 01 Apr 2026 00:00:00 +0000

Python is the default language for security tooling, but Rust offers compelling advantages for CLI tools that need to be fast, distributable as a single binary, and safe by default. Here’s how I built a threat intelligence lookup tool in Rust.

The goal

A single binary that:

Accepts an IP, domain, or hash as input
Queries VirusTotal, AbuseIPDB, and Shodan in parallel
Outputs a unified JSON report

Project setup

cargo init threat-lookup
cd threat-lookup
cargo add reqwest --features json,rustls-tls
cargo add tokio --features full
cargo add serde --features derive
cargo add serde_json
cargo add clap --features derive

CLI argument parsing with Clap

use clap::Parser;

#[derive(Parser, Debug)]
#[command(name = "threat-lookup")]
#[command(about = "Query threat intel APIs for IOCs")]
struct Args {
 /// The indicator to look up (IP, domain, or hash)
 indicator: String,

 /// Output format
 #[arg(short, long, default_value = "json")]
 format: String,

 /// Verbose output
 #[arg(short, long)]
 verbose: bool,
}

Parallel API queries with Tokio

The key advantage of Rust here is safe, zero-cost concurrency. All three API calls happen simultaneously:

Writing Effective YARA Rules for Cobalt Strike Beacon Detection

Sat, 28 Mar 2026 00:00:00 +0000

Cobalt Strike remains one of the most prevalent post-exploitation frameworks used by both red teams and threat actors. Detecting its beacons through YARA rules is a fundamental skill for any SOC analyst or threat hunter.

Understanding beacon artifacts

Cobalt Strike beacons leave identifiable patterns in both their staged and stageless payloads. The key areas to target are:

Configuration blocks — the beacon stores its config in a predictable structure
Sleep mask routines — the obfuscation applied during sleep cycles
Named pipe patterns — default pipe names are a common indicator

A basic detection rule

rule CobaltStrike_Beacon_Config
{
 meta:
 description = "Detects Cobalt Strike beacon configuration block"
 author = "SOC Team"
 date = "2026-03"
 severity = "high"

 strings:
 $config_header = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? }
 $default_pipe = "\\\\.\\pipe\\msagent_" ascii wide
 $watermark = { 00 09 00 02 00 04 }

 condition:
 uint16(0) == 0x5A4D and
 filesize < 1MB and
 ($config_header or $default_pipe) and
 $watermark
}

Hunting in memory

For in-memory detection, you’ll want rules that match against the decrypted beacon configuration. Use a tool like pe-sieve or BeaconEye to dump process memory first, then scan:

Security on Clean Tech