hslatman/awesome-threat-intelligenceCurated directory of threat intelligence sources, feeds, frameworks, tools, and research for SOC/CTI teams—covering IOCs, STIX/TAXII formats, and platforms.
A curated list of awesome Threat Intelligence resources
A concise definition of Threat Intelligence: evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.
Feel free to contribute.
Most of the resources listed below provide lists and/or APIs to obtain (hopefully) up-to-date information with regards to threats. Some consider these sources as threat intelligence, opinions differ however. A certain amount of (domain- or business-specific) analysis is necessary to create true threat intelligence.
| AbuseIPDB | AbuseIPDB is a project dedicated to helping combat the spread of hackers, spammers, and abusive activity on the internet. It's mission is to help make Web safer by providing a central blacklist for webmasters, system administrators, and other interested parties to report and find IP addresses that have been associated with malicious activity online.. |
| APT Groups and Operations | A spreadsheet containing information and intelligence about APT groups, operations and tactics. |
| Binary Defense IP Banlist | Binary Defense Systems Artillery Threat Intelligence Feed and IP Banlist Feed. |
| BGP Ranking | Ranking of ASNs having the most malicious content. |
| Botnet Tracker | Tracks several active botnets. |
| BOTVRIJ.EU | Botvrij.eu provides different sets of open source IOCs that you can use in your security devices to detect possible malicious activity. |
| BruteForceBlocker | BruteForceBlocker is a perl script that monitors a server's sshd logs and identifies brute force attacks, which it then uses to automatically configure firewall blocking rules and submit those IPs back to the project site, http://danger.rulez.sk/projects/bruteforceblocker/blist.php. |
| C&C Tracker | A feed of known, active and non-sinkholed C&C IP addresses, from Bambenek Consulting. Requires license for commercial use. |
| CertStream | Real-time certificate transparency log update stream. See SSL certificates as they're issued in real time. |
| CCSS Forum Malware Certificates | The following is a list of digital certificates that have been reported by the forum as possibly being associated with malware to various certificate authorities. This information is intended to help prevent companies from using digital certificates to add legitimacy to malware and encourage prompt revocation of such certificates. |
| CI Army List | A subset of the commercial CINS Score list, focused on poorly rated IPs that are not currently present on other threatlists. |
| Cisco Umbrella | Probable Whitelist of the top 1 million sites resolved by Cisco Umbrella (was OpenDNS). |
| Cloudmersive Virus Scan | Cloudmersive Virus Scan APIs scan files, URLs, and cloud storage for viruses. They leverage continuously updated signatures for millions of threats, and advanced high-performance scanning capabilities. The service is free, but requires you register for an account to retrieve your personal API key. |
| CrowdSec Console | The largest crowd-sourced CTI, updated in near real-time, thanks to CrowdSec a next-gen, open-source, free, and collaborative IDS/IPS software. CrowdSec is able to analyze visitor behavior & provide an adapted response to all kinds of attacks. Users can share their alerts about threats with the community and benefit from the network effect. The IP addresses are collected from real attacks and are not coming exclusively from a honeypot network. |
| Cyber Cure free intelligence feeds | Cyber Cure offers free cyber threat intelligence feeds with lists of IP addresses that are currently infected and attacking on the internet. There are list of urls used by malware and list of hash files of known malware that is currently spreading. CyberCure is using sensors to collect intelligence with a very low false positive rate. Detailed documentation is available as well. |
| Cyware Threat Intelligence Feeds | Cyware’s Threat Intelligence feeds brings to you the valuable threat data from a wide range of open and trusted sources to deliver a consolidated stream of valuable and actionable threat intelligence. Our threat intel feeds are fully compatible with STIX 1.x and 2.0, giving you the latest information on malicious malware hashes, IPs and domains uncovered across the globe in real-time. |
| DataPlane.org | DataPlane.org is a community-powered Internet data, feeds, and measurement resource for operators, by operators. We provide reliable and trustworthy service at no cost. |
| Focsec.com |
