pCapitan — threat feeds, YARA rules and the abuse.ch key

Everything is in 🔄 Updates & feeds. pCapitan checks traffic against these lists on your computer; nothing about your captures is sent anywhere.

One-click threat feeds

Click Import next to a feed, then open (or re-analyse) a capture. The list includes Spamhaus DROP (IPv4 and IPv6), CINS Army, Tor exit nodes, C2 servers, OpenPhish, public DNS-over-HTTPS servers, JA4 fingerprints, Emerging Threats and Cisco Talos rules.

The free abuse.ch Auth-Key

ThreatFox, URLhaus and MalwareBazaar need a free key from abuse.ch:

1. Sign in at auth.abuse.ch and copy your Auth-Key.
2. Paste it in Updates & feeds → abuse.ch Auth-Key and click Save. It stays on your computer.
3. Import the three feeds.

YARA rules

Files rebuilt from a capture (🔎 Forensics → Files) are scanned with YARA rules. Click ⬇ YARA-Forge core (or extended) to download a free, curated rule set, or ⬆ Add my .yar file. A match becomes a finding.

Actively exploited vulnerabilities

Any CVE on CISA’s Known Exploited Vulnerabilities list gets a 🔥 actively exploited badge. Refresh from NVD updates the vulnerability database.

Network owners

Each internet address shows the network that owns it (for example AS15169 GOOGLE). The table ships with pCapitan; Update now downloads the latest.