Open-Source-Threat-Intel-Feeds - This repository contains Open Source freely usable

项目说明

Free Threat Intel/IOC Feeds ![Tweet]()

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. The CSV ThreatIntelFeeds is stored in a structured manner based on the , Description, Category and URL. The offering ThreatIntelFeeds are described below.
The following feed categories are a:

SSL

IP

DNS

URL

MD5

SHA1

SHA256

CVEID

JA3

NamePipes

The content is served as is. When using the content in a business en the conditions have to be researched before using the content, it might be that some content cannot be used freely under certain conditions. It is your own responsibility to research if that is the case or not.

| Category | Count |
| --- | --- |
| DNS | 17 |
| IP | 78 |
| MD5 | 12 |
| SHA1 | 5 |
| SHA256 | 8 |
| SSL | 1 |
| URL | 23 |
| CVEID | 4 |
| RANSOMWARELEAK | 1 |
| JA3 | 1 |
| NamePipe | 1 |

Combine Threat Intel in your EDR and SIEM

The feeds a in this repository can be used to perform threat hunting in your EDR or SIEM solution to hunt for malicious activity. For Defender For Endpoint and Sentinel, some KQL hunting rules ha been written to be implemented in your EDR or SIEM. See: KQL Hunting Queries

KQL

You can easily implement the open-source feeds in KQL for M365D Ad Hunting or Sentinel. This is done by using the externaldata operator. This operator can take an external link as input and parse the result to a data table that can be used to join or to filter based on your other tables. An example is shown below and the output is a table just like any other.

!alt text

The documentation explains the different parameters that are used, such as if you want to ignore the first row or not.

Combining EDR Network Traffic and IOC Feeds

The results of combining the EDR Network Traffic and the IOC feed is shown below. This detection can help you identify devices that connect to IPs that host command and control servers.

Contributions

Contributions are much appreciated to make this list with free Threat Intel/IOC feeds as big and as up-to-date as possible. You can contribute by creating a pull request. This PR must contain the following content:
1. Add the link to the feed in the README.md file. If there is not a section yet in which the source fits, create a new section.
2. Add the details to the ThreatIntelFeeds.csv file, the format which is used is shown below. The Category refers to the feed categories shown above.

3. The source must be free and usable without any account or API token needed.
4. Use the .py script to the content of the CSV file. This can be done by running it in the *script* directory.
5. Update the IOC Feed Statistics table by running the GenerateTableStatistics.py which will save the markdown table in the *StatisticsTable.md* file. This table can then be pasted above.

Abuse.ch

Terms of Service:

Blocklist.de

Terms of Service:

IPSum

C2IntelFeeds

Montysecurity Feeds

Carbon Black

tweetfeed.live

Botvrij

Proofpoint

CINSscore

Phishing Army

Alienvault

Cisco Talos

Binarydefense

CISA

- CSV

- JSON

eCrimeLabs

MISP Feed CERT-FR

Mr. Looquer IOC Feed

SNORT

ELLIO: IP Feed (Community )

Terms of Service:

CyberCure

DigitalSide Threat-Intel

OpenPhish

PhishTank

Cert.PL

GreenSnow

NIST

Other Github based feeds

Url Abuse

Latest 500 entries of DB in CS -

threatcluster.io

threatview.io

SiberKapan

VPN

Tor

Ransomware Live

NamePipes

Notable links

Sources with multiple feeds depending on threat

Spamhaus Don't Route Or Peer Lists (DROP) lists

项目信息

开发语言：Python

Star 数：952

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。