The Malware Families Catalog exposes a free, public threat intelligence API, OpenAPI 3.1 specification, and official Python SDK letting you query 2,982 malware families programmatically. Zero authentication or API keys required.
| Endpoint / Resource | Format | Description |
|---|---|---|
/api/families.json | JSON | Full index of all 2,982 families with categorized functional classification and curation depth tiers. |
/api/{family_name}.json | JSON | Detailed profile for a single family: aliases, MITRE ATT&CK, severity rating, containment procedures, anti-patterns, and FAQs. |
/api/mitre.json | JSON | MITRE ATT&CK Reverse Index: Mapping of Enterprise Techniques (e.g. T1055, T1566.001) to associated malware families. |
/api/stix2_bundle.json | STIX 2.1 | OASIS STIX 2.1 Threat Intel Bundle: 15,018 objects (malware, attack-patterns, relationships) for SIEM/TIP (Splunk, OpenCTI, MISP) ingestion. |
/api/yara/ | YARA Feed | Master YARA Threat Hunting Feed: 5,962 multi-tier detection rules (.yar & manifest) and master rules.yar for ClamAV / YARA daemon ingestion. |
/api/sigma/ | Sigma Rules | Production Sigma Rules: 2,981 YAML & JSON behavioral detection rules for SIEM/EDR log analytics. |
/api/misp/ | MISP Feed | Standard MISP Community Threat Feed: Manifest and event JSONs ready for zero-configuration ingestion into any MISP instance. |
/api/otx/pulses.json | OTX Pulses | AlienVault OTX Pulse Feed: 488 curated threat intelligence pulses with verified file hashes, CVEs, and MITRE tags for AT&T AlienVault USM. |
/research/ | DataCite & BibTeX | Academic Research Portal: Peer-reviewed citations, DataCite 4.4 metadata XML, and Open Science DOIs for scholars and universities. |
/api/openapi.json | OpenAPI 3.1 | OpenAPI Specification: Complete machine-readable contract for automated client generation and gateway proxies. |
malware-families-catalog-technical-report.pdf | Academic Technical Report: Formal methodology, CAIRN attribution framework, and EMBER 2018 statistical study (SHD-TR-2026-08-MF). | |
SHA256SUMS.txt | Text | Cryptographic Manifest: Published SHA-256 checksums verifying data and document integrity. |
malware-families-catalog)The catalog provides an official, zero-dependency Python client library and command-line tool designed for SOC automations, threat intelligence pipelines, and incident response triage.
# Install via pip
pip install malware-families-catalogmalware-catalog)# Lookup detailed family profile and immediate containment steps
malware-catalog lookup emotet
# Export machine-readable JSON for SIEM / jq pipelines
malware-catalog lookup emotet --json
# Search catalog by keyword or threat category
malware-catalog search ransomware --limit 10
# Reverse query MITRE ATT&CK techniques to discover employing families
malware-catalog mitre T1055 --limit 15
# View catalog threat metrics and enrichment distribution
malware-catalog statsfrom malware_families_catalog import MalwareCatalogClient
client = MalwareCatalogClient()
# 1. Lookup a specific malware family
family = client.get_family("emotet")
if family:
print(f"Family: {family.family} ({family.severity_rating})")
print(f"Category: {family.category}")
print(f"Samples: {family.sample_count:,}")
print(f"Techniques: {family.mitre_attack}")
for step in family.containment_steps:
print(f"Containment Action: {step}")
# 2. Query families by category
ransomware_list = client.list_families(category="ransomware")
print(f"Total ransomware families: {len(ransomware_list)}")
# 3. Lookup MITRE ATT&CK technique reverse mappings
technique = client.get_technique("T1566.001")
if technique:
print(f"Technique: {technique['name']} ({technique['tactic']})")
print(f"Associated families: {len(technique['families'])}")
// Fetch the full family index
fetch("https://malware-families-catalog.systemhelpdesk.com/api/families.json")
.then(res => res.json())
.then(data => {
console.log(`Total families: ${data.total}`);
data.families.filter(f => f.category === 'ransomware')
.forEach(f => console.log(f.family));
});
// Fetch a specific family profile
fetch("https://malware-families-catalog.systemhelpdesk.com/api/emotet.json")
.then(res => res.json())
.then(family => {
console.log(`${family.family}: ${family.description.slice(0,100)}...`);
});
Explore schema models, inspect endpoint parameters, and execute live queries directly against the production catalog API:
This is a static JSON API distributed across a global CDN. There are no rate limits, no API keys, and no authentication walls. Responses are cached and distributed under the Apache-2.0 license. Data derived from EMBER 2018 and SystemHelpDesk research operations.