mandiant/ThreatPursuit-VM

Health v2 · maintenance only

Flags: archived no_license

Adoption not part of the score

1306 stars · 262 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ThreatPursuit-VM is an open-source Windows-based virtual machine distribution from Mandiant preloaded with tools for threat intelligence analysis, threat hunting, and malware triage. It is installed via a PowerShell/Boxstarter script that configures a Windows 10 VM with analytics, visualization, and hunting tooling.

Use cases

• set up a threat intelligence analysis workstation quickly
• build a malware analysis VM for threat hunting
• get a preconfigured Windows VM with MISP, OpenCTI, and Maltego
• stand up a hunting environment with Jupyter, Elasticsearch, and Splunk
• customize a Windows security analyst VM with an install script

When to choose

• you are an intel or malware analyst needing a ready-made Windows tooling environment
• you want a customizable, scriptable alternative to prebuilt security VM images
• you need threat hunting tools like MISP, OpenCTI, Maltego, and Splunk in one VM

When to avoid

• you need a Linux-based malware analysis distribution like FLARE-VM alternatives or REMnux
• you require actively maintained tooling - the last release was mid-2023
• you cannot run Windows 10 VMs with 120+ GB disk and virtualization support

Facets

application · maturity maintenance

security developer-tools data-science analytics search-engine machine-learning security osint windows windows self-hosted threat-intelligence threat-hunting malware-analysis virtual-machine boxstarter powershell security-distribution mandiant docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mandiant/ThreatPursuit-VM")