Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/mvt/cellebrite/README.md

@@ -0,0 +1,6 @@
+# Cellebrite
+
+Indicators of compromise to detect Cellebrite on Android.
+
+Sources:
+* [From Protest to Peril - Cellebrite Used Against Jordanian Civil Society](https://citizenlab.ca/research/from-protest-to-peril-cellebrite-used-against-jordanian-civil-society/)

data/ioc/spyware/mvt/cellebrite/cellebrite.stix2

@@ -0,0 +1,40 @@
+{
+    "type": "bundle",
+    "id": "bundle--ce7cc5a8-fa53-4ff4-841b-cf526f3c8b07",
+    "objects": [
+        {
+            "type": "malware",
+            "spec_version": "2.1",
+            "id": "malware--afe324d5-5d65-4060-92f9-98a5012557d0",
+            "created": "2026-01-22T21:58:55.050482Z",
+            "modified": "2026-01-22T21:58:55.050482Z",
+            "name": "Cellebrite",
+            "description": "IOCs for Cellebrite",
+            "is_family": false
+        },
+        {
+            "type": "indicator",
+            "spec_version": "2.1",
+            "id": "indicator--55319823-913e-4283-9454-156ef3bd285c",
+            "created": "2026-01-22T21:58:55.051167Z",
+            "modified": "2026-01-22T21:58:55.051167Z",
+            "indicator_types": [
+                "malicious-activity"
+            ],
+            "pattern": "[app:id='com.client.appA']",
+            "pattern_type": "stix",
+            "pattern_version": "2.1",
+            "valid_from": "2026-01-22T21:58:55.051167Z"
+        },
+        {
+            "type": "relationship",
+            "spec_version": "2.1",
+            "id": "relationship--2abc42e6-3375-4bd3-a746-6199e8af5ce8",
+            "created": "2026-01-22T21:58:55.063505Z",
+            "modified": "2026-01-22T21:58:55.063505Z",
+            "relationship_type": "indicates",
+            "source_ref": "indicator--55319823-913e-4283-9454-156ef3bd285c",
+            "target_ref": "malware--afe324d5-5d65-4060-92f9-98a5012557d0"
+        }
+    ]
+}

data/ioc/spyware/mvt/cellebrite/generate_stix.py

@@ -0,0 +1,38 @@
+import sys
+import os
+from stix2.v21 import (Indicator, Malware, Relationship, Bundle)
+
+
+from stix2 import CustomObservable
+
+def hash_format(hash):
+    if len(hash) == 32:
+        return "md5"
+    elif len(hash) == 40:
+        return "sha1"
+    elif len(hash) == 64:
+        return "sha256"
+    else:
+        return None
+
+if __name__ == "__main__":
+    malware_name = "Cellebrite"
+    stix2_file_name = "cellebrite.stix2"
+    if os.path.isfile(stix2_file_name):
+        os.remove(stix2_file_name)
+
+    with open("package_names.txt") as f:
+        package_names = list(set([a.strip() for a in f.read().split()]))
+
+    res = []
+    malware = Malware(name=malware_name, is_family=False, description="IOCs for Cellebrite")
+    res.append(malware)
+    for package_name in package_names:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[app:id='{}']".format(package_name), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    bundle = Bundle(objects=res)
+    with open(stix2_file_name, "w+") as f:
+        f.write(bundle.serialize(pretty=True, indent=4))
+    print("{} file created".format(stix2_file_name))

data/ioc/spyware/mvt/cellebrite/package_names.txt

@@ -0,0 +1 @@
+com.client.appA