title: "Intel Codex" description: "Operational manual for digital investigators: OSINT platform techniques, security procedures, forensics and real-world case studies."

Intel Codex

The open-source field manual for OSINT, DFIR and cybersecurity investigations.

Standard operating procedures for investigators, security researchers and CTF players. Written to be executed during a case, not read once and bookmarked.

OSINT · DFIR · Malware · Pentesting · Blockchain · Cloud · OPSEC · CTF

41 SOPs · 20 investigation · 21 security

This is not a link list and not a tool dump. Each SOP is a full procedure: scope and legal boundaries, the commands to run on Windows, Linux and macOS, what the output means, how to preserve it as evidence, and where to hand off. The malware SOP is 2,385 lines; the web application one is 3,588.

Three ways to use it


Read it online	lecodex.xyz — full-text search, graph view, no install
Run it locally	Clone this repo and open it as an Obsidian vault: backlinks, graph, offline
Improve it	Fork, edit the Markdown, open a PR. See CONTRIBUTING.md

A sense of the depth

Mixer & Privacy-Pool Tracing — CoinJoin clustering attacks, Tornado Cash on-chain heuristics, defeating cross-chain bridge obfuscation, and where privacy-coin research actually stops
Email & BEC Forensics — Received-chain reconstruction, SPF/DKIM/DMARC/ARC evaluation, and the wire-recall pathway through SWIFT MT103, Fedwire and SEPA
Malware Analysis — 13 phases from safe acquisition to IOC publication, static and dynamic
Sensitive Crime Intake & Escalation — the SOP for what to do when a case turns into CSAM, terrorism or a threat to life

Where to look

Investigate	Analyze	Assess	Practice
OSINT techniques	Malware	Pentesting	CTF
Social platforms	Forensics	Web & mobile	Writeups
Dark web	Cloud forensics	Active Directory	Case studies
Financial & AML	Email & BEC	Cloud & containers	Exercises

Full listings: Investigations · Security · CTF

Start here

Whatever you are investigating, these two come first:

Legal & Ethics Review — authorization and compliance before collection
OPSEC Planning — attribution separation, infrastructure hygiene

Then pick your track:

You are	Go to
An investigator	Platform SOPs, then Collection Log and Entity Dossier
A security analyst	Malware Analysis and Hash Generation
A pentester	Pentesting Index, scoped to your engagement
A CTF player	Challenge Methodology and Cheat Sheets
Learning from zero	Investigation Workflow, then the example case

Quick start

git clone https://github.com/gl0bal01/intel-codex.git
# Obsidian → File → Open Vault → select the cloned folder

Requires Obsidian v1.0+. Or skip the install and read it on lecodex.xyz.

intel-codex/
├── Investigations/   OSINT techniques and platform guides
│   ├── Platforms/    Twitter/X, Telegram, Discord, Instagram, LinkedIn, Reddit, TikTok, Bluesky
│   └── Techniques/   OPSEC, legal, image analysis, blockchain, dark web, reporting
├── Security/
│   ├── Analysis/     Malware, forensics, reverse engineering, cryptography, cloud, BEC
│   └── Pentesting/   Web, mobile, AD, cloud, containers, wireless, firmware, bug bounty
├── CTF/              Methodology, tooling, cheat sheets, writeups
└── Cases/            Templates, worked example, student exercises, glossary

Learning paths

Six 6-week tracks. Each links the SOPs in order.

Track	Weeks 1–2	Weeks 3–4	Weeks 5–6
Investigations	Legal + OPSEC + platforms	Image/Video, Financial	Practice + reporting
Security analyst	Malware fundamentals	Reverse engineering	Advanced malware, IOC generation
Pentester	Web app security	Linux + AD	Mobile + firmware
Bug bounty	Web app + bug bounty	Vulnerability research	Live programs
CTF	Reverse engineering + crypto	Pwn and web challenges	Competition practice
DFIR	Forensics + hashing	Malware + incident response	Memory forensics, timelines

What makes it different

Copy-paste ready — commands given for Windows, Linux and macOS
Heavily cross-referenced — SOPs link to the procedures they depend on
Legal and ethical first — every SOP states its boundaries before its techniques
OPSEC by default — attribution and infrastructure hygiene built into each procedure
Practical over theoretical — written from real operations, not literature reviews
Living documentation — updated from field experience, with reusable templates

Contributing

Contributions are welcome, from a typo to a whole new SOP. Fork, branch, edit, update the relevant index, open a PR. Conventions, style guide and review process are in CONTRIBUTING.md.

Legal & ethics

This vault is for educational and authorized investigative purposes only.

Review the Legal & Ethics SOP before any investigation
Respect privacy law (GDPR, CCPA, local regulation)
Investigate only with proper authorization
Escalate sensitive crimes through the Escalation SOP

Users are responsible for compliance with applicable law.

More from gl0bal01

OSINT Foundations · Cybersecurity · Reverse Engineering · AI · Cheatsheets

License

MIT. If you use or fork this vault, attribution is appreciated.

Built with Obsidian.