\n \n | \n AbuseIPDB\n | \n \n AbuseIPDB is a project dedicated to helping combat the spread of hackers, spammers, and abusive activity on the internet. It's mission is to help make Web safer by providing a central blacklist for webmasters, system administrators, and other interested parties to report and find IP addresses that have been associated with malicious activity online..\n | \n
\n \n | \n APT Groups and Operations\n | \n \n A spreadsheet containing information and intelligence about APT groups, operations and tactics.\n | \n
\n \n | \n Binary Defense IP Banlist\n | \n \n Binary Defense Systems Artillery Threat Intelligence Feed and IP Banlist Feed.\n | \n
\n \n | \n BGP Ranking\n | \n \n Ranking of ASNs having the most malicious content.\n | \n
\n \n | \n Botnet Tracker\n | \n \n Tracks several active botnets.\n | \n
\n \n | \n BOTVRIJ.EU\n | \n \n Botvrij.eu provides different sets of open source IOCs that you can use in your security devices to detect possible malicious activity.\n | \n
\n \n | \n BruteForceBlocker\n | \n \n BruteForceBlocker is a perl script that monitors a server's sshd logs and identifies brute force attacks, which it then uses to automatically configure firewall blocking rules and submit those IPs back to the project site, http://danger.rulez.sk/projects/bruteforceblocker/blist.php.\n | \n
\n \n | \n C&C Tracker\n | \n \n A feed of known, active and non-sinkholed C&C IP addresses, from Bambenek Consulting. Requires license for commercial use.\n | \n
\n \n | \n CertStream\n | \n \n Real-time certificate transparency log update stream. See SSL certificates as they're issued in real time.\n | \n
\n \n | \n CCSS Forum Malware Certificates\n | \n \n The following is a list of digital certificates that have been reported by the forum as possibly being associated with malware to various certificate authorities. This information is intended to help prevent companies from using digital certificates to add legitimacy to malware and encourage prompt revocation of such certificates.\n | \n
\n \n | \n CI Army List\n | \n \n A subset of the commercial CINS Score list, focused on poorly rated IPs that are not currently present on other threatlists.\n | \n
\n \n | \n Cisco Umbrella\n | \n \n Probable Whitelist of the top 1 million sites resolved by Cisco Umbrella (was OpenDNS).\n\t | \n
\n \n | \n Cloudmersive Virus Scan\n | \n \n Cloudmersive Virus Scan APIs scan files, URLs, and cloud storage for viruses. They leverage continuously updated signatures for millions of threats, and advanced high-performance scanning capabilities. The service is free, but requires you register for an account to retrieve your personal API key.\n | \n
\n \n | \n CrowdSec Console\n | \n \n The largest crowd-sourced CTI, updated in near real-time, thanks to CrowdSec a next-gen, open-source, free, and collaborative IDS/IPS software. CrowdSec is able to analyze visitor behavior & provide an adapted response to all kinds of attacks. Users can share their alerts about threats with the community and benefit from the network effect. The IP addresses are collected from real attacks and are not coming exclusively from a honeypot network.\n | \n
\n \n | \n Cyber Cure free intelligence feeds\n | \n \n Cyber Cure offers free cyber threat intelligence feeds with lists of IP addresses that are currently infected and attacking on the internet. There are list of urls used by malware and list of hash files of known malware that is currently spreading. CyberCure is using sensors to collect intelligence with a very low false positive rate. Detailed documentation is available as well.\n | \n
\n\n | \n Cyware Threat Intelligence Feeds\n | \n \n Cyware’s Threat Intelligence feeds brings to you the valuable threat data from a wide range of open and trusted sources to deliver a consolidated stream of valuable and actionable threat intelligence. Our threat intel feeds are fully compatible with STIX 1.x and 2.0, giving you the latest information on malicious malware hashes, IPs and domains uncovered across the globe in real-time.\n | \n
\n \n | \n DataPlane.org\n | \n \n DataPlane.org is a community-powered Internet data, feeds, and measurement resource for operators, by operators. We provide reliable and trustworthy service at no cost.\n | \n
\n \n | \n Focsec.com\n | \n \n Focsec.com provides a API for detecting VPNs, Proxys, Bots and TOR requests. Always up-to-date data helps with detecting suspicious logins, fraud and abuse. Code examples can be found in the documentation.\n | \n
\t\n \n | \n DigitalSide Threat-Intel\n | \n \n Contains sets of Open Source Cyber Threat Intelligence indicators, mostly based on malware analysis and compromised URLs, IPs and domains. The purpose of this project is to develop and test new ways to hunt, analyze, collect and share relevants IoCs to be used by SOC/CSIRT/CERT/individuals with minimun effort. Reports are shared in three ways: STIX2, CSV and MISP Feed. Reports are published also in the project's Git repository.\n | \n
\n \n | \n Disposable Email Domains\n | \n \n A collection of anonymous or disposable email domains commonly used to spam/abuse services.\n | \n
\n \n | \n DNS Trails\n | \n \n Free intelligence source for current and historical DNS information, WHOIS information, finding other websites associated with certain IPs, subdomain knowledge and technologies. There is a IP and domain intelligence API available as well. \n | \n
\n \n | \n ELLIO: IP Feed (community free version)\n | \n \n A threat list of known malicious IP addresses anticipated to pose potential threats to your network in the near future, known benign scanners, and IP addresses of actors with unknown intent. It is provided with a 24-hour delay for personal, non-commercial use but still provides exceptional protection compared to other open IP threat lists/feeds.\n | \n
\n \n | \n Emerging Threats Firewall Rules\n | \n \n A collection of rules for several types of firewalls, including iptables, PF and PIX.\n | \n
\n \n | \n Emerging Threats IDS Rules\n | \n \n A collection of Snort and Suricata rules files that can be used for alerting or blocking.\n | \n
\n \n | \n ExoneraTor\n | \n \n The ExoneraTor service maintains a database of IP addresses that have been part of the Tor network. It answers the question whether there was a Tor relay running on a given IP address on a given date.\n | \n
\n \n | \n Exploitalert\n | \n \n Listing of latest exploits released.\n | \n
\n \n | \n FastIntercept\n | \n \n\t Intercept Security hosts a number of free IP Reputation lists from their global honeypot network.\n | \n
\n \n | \n ZeuS Tracker\n | \n \n The Feodo Tracker abuse.ch tracks the Feodo trojan.\n | \n
\n \n | \n FireHOL IP Lists\n | \n \n 400+ publicly available IP Feeds analysed to document their evolution, geo-map, age of IPs, retention policy, overlaps. The site focuses on cyber crime (attacks, abuse, malware).\n | \n
\n \n | \n FraudGuard\n | \n \n FraudGuard is a service designed to provide an easy way to validate usage by continuously collecting and analyzing real-time internet traffic.\n | \n
\n \n | \n GreyNoise\n | \n \n GreyNoise collects and analyzes data on Internet-wide scanning activity. It collects data on benign scanners such as Shodan.io, as well as malicious actors like SSH and telnet worms. \n | \n
\n \n | \n GriffinGuard\n | \n \n GriffinGuard is a cybersecurity platform delivering real-time threat intelligence by continuously analyzing global internet traffic and exploitation patterns. It provides free data search, and some free IP blocklists.\n | \n
\n \n | \n HoneyDB\n | \n \n HoneyDB provides real time data of honeypot activity. This data comes from honeypots deployed on the Internet using the HoneyPy honeypot. In addition, HoneyDB provides API access to collected honeypot activity, which also includes aggregated data from various honeypot Twitter feeds.\n | \n
\n \n | \n Icewater\n | \n \n 12,805 Free Yara rules created by Project Icewater.\n | \n
\n \n | \n Infosec - CERT-PA\n | \n \n Malware samples collection and analysis, blocklist service, vulnerabilities database and more. Created and managed by CERT-PA.\n | \n
\n \n | \n InQuest Labs\n | \n \n An open, interactive, and API driven data portal for security researchers. Search a large corpus of file samples, aggregate reputation information, and IOCs extracted from public sources. Augment YARA development with tooling to generate triggers, deal with mixed-case hex, and generate base64 compatible regular expressions.\n | \n
\n \n | \n I-Blocklist\n | \n \n I-Blocklist maintains several types of lists containing IP addresses belonging to various categories. Some of these main categories include countries, ISPs and organizations. Other lists include web attacks, TOR, spyware and proxies. Many are free to use, and available in various formats.\n | \n
\n \n | \n IPsum\n | \n \n IPsum is a threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses. All lists are automatically retrieved and parsed on a daily (24h) basis and the final result is pushed to this repository. List is made of IP addresses together with a total number of (black)list occurrence (for each). Created and managed by Miroslav Stampar.\n | \n
\n \n\t| \n James Brine Threat Intelligence Feeds\n | \n \n\t\tJamesBrine provides daily threat intelligence feeds for malicious IP addresses from internationally located honeypots on cloud and private infrastructure covering a variety of protocols including SSH, FTP, RDP, GIT, SNMP and REDIS. The previous day's IOCs are available in STIX2 as well as additional IOCs such as suspicious URIs and newly registered domains which have a high probaility of use in phishing campaigns.\n | \n
\n \n | \n Kaspersky Threat Data Feeds\n | \n \nContinuously updated and inform your business or clients about risks and implications associated with cyber threats. The real-time data helps you to mitigate threats more effectively and defend against attacks even before they are launched. Demo Data Feeds contain truncated sets of IoCs (up to 1%) compared to the commercial ones\n | \n
\n \n | \n Majestic Million\n | \n \n Probable Whitelist of the top 1 million web sites, as ranked by Majestic. Sites are ordered by the number of referring subnets. More about the ranking can be found on their blog.\n | \n
\n \n | \n Maldatabase\n | \n \n Maldatabase is designed to help malware data science and threat intelligence feeds. Provided data contain good information about, among other fields, contacted domains, list of executed processes and dropped files by each sample. These feeds allow you to improve your monitoring and security tools. Free services are available for Security Researchers and Students. \n | \n
\n \n | \n Malpedia\n | \n \nThe primary goal of Malpedia is to provide a resource for rapid identification and actionable context when investigating malware. Openness to curated contributions shall ensure an accountable level of quality in order to foster meaningful and reproducible research. \n | \n
\n \n | \n MalShare.com\n | \n \n The MalShare Project is a public malware repository that provides researchers free access to samples.\n | \n
\n \n | \n Maltiverse\n | \n \n The Maltiverse Project is a big and enriched IoC database where is possible to make complex queries, and aggregations to investigate about malware campaigns and its infrastructures. It also has a great IoC bulk query service.\n | \n
\n \n | \n MalwareBazaar\n | \n \n MalwareBazaar is a project from abuse.ch with the goal of sharing malware samples with the infosec community, AV vendors and threat intelligence providers.\n | \n
\t\n \n | \n Malware Domain List\n | \n \n A searchable list of malicious domains that also performs reverse lookups and lists registrants, focused on phishing, trojans, and exploit kits.\n | \n
\n \n | \n Malware Patrol\n | \n \n Malware Patrol provides block lists, data feeds and threat intelligence to companies of all sizes. Because our specialty is cyber threat intelligence, all our resources go into making sure it is of the highest quality possible. We believe a security team and it's tools are only as good as the data used. This means our feeds are not filled with scraped, unverified indicators. We value quality over quantity. \n | \n
\n \n | \n Malware-Traffic-Analysis.net\n | \n \n This blog focuses on network traffic related to malware infections. Contains traffic analysis exercises, tutorials, malware samples, pcap files of malicious network traffic, and technical blog posts with observations.\n | \n
\n \n | \n MalwareDomains.com\n | \n \n The DNS-BH project creates and maintains a listing of domains that are known to be used to propagate malware and spyware. These can be used for detection as well as prevention (sinkholing DNS requests).\n | \n
\n \n | \n MetaDefender Cloud\n | \n \n MetaDefender Cloud Threat Intelligence Feeds contains top new malware hash signatures, including MD5, SHA1, and SHA256. These new malicious hashes have been spotted by MetaDefender Cloud within the last 24 hours. The feeds are updated daily with newly detected and reported malware to provide actionable and timely threat intelligence.\n | \n
\n \n | \n NoThink!\n | \n SNMP, SSH, Telnet Blacklisted IPs from Matteo Cantoni's Honeypots | \n
\n \n | \n NormShield Services\n | \n \n NormShield Services provide thousands of domain information (including whois information) that potential phishing attacks may come from. Breach and blacklist services also available. There is free sign up for public services for continuous monitoring.\n | \n
\n \n | \n NovaSense Threats\n | \n \n NovaSense is the Snapt threat intelligence center, and provides insights and tools for pre-emptive threat protection and attack mitigation. NovaSense protects clients of all sizes from attackers, abuse, botnets, DoS attacks and more.\n | \n
\n \n | \n Obstracts\n | \n \n The RSS reader for cybersecurity teams. Turn any blog into structured and actionable threat intelligence.\n | \n
\n \n | \n OpenPhish Feeds\n | \n \n OpenPhish receives URLs from multiple streams and analyzes them using its proprietary phishing detection algorithms. There are free and commercial offerings available.\n | \n
\n \n | \n 0xSI_f33d\n | \n \n Free service for detecting possbible phishing and malware domains, blacklisted IPs within the Portuguese cyberspace.\n | \n
\n \n | \n PhishTank\n | \n \n PhishTank delivers a list of suspected phishing URLs. Their data comes from human reports, but they also ingest external feeds where possible. It's a free service, but registering for an API key is sometimes necessary.\n | \n
\n \n | \n PickupSTIX\n | \n \n PickupSTIX is a feed of free, open-source, and non-commercialized cyber threat intelligence. Currently, PickupSTIX uses three public feeds and distributes about 100 new pieces of intelligence each day. PickupSTIX translates the various feeds into STIX, which can communicate with any TAXII server. The data is free to use and is a great way to begin using cyber threat intelligence.\n | \n
\n \n | \n Q-Feeds Threat Intelligence\n | \n \n Q-Feeds is a cybersecurity company that brings together data from OSINT, proprietary research, and commercial threat intelligence feeds to offer a well-rounded and highly actionable solution. Their Threat Intelligence Portal (TIP) makes it easy for organizations to access and manage this data in real-time. By integrating with firewalls, SIEMs, and other security platforms, Q-Feeds helps businesses proactively block connections to known malicious IPs, domains, and URLs—before threats can do harm. They also have a community version available on request.\n | \n
\n \n | \n REScure Threat Intel Feed\n | \n \n [RES]cure is an independant threat intelligence project performed by the Fruxlabs Crack Team to enhance their understanding of the underlying architecture of distributed systems, the nature of threat intelligence and how to efficiently collect, store, consume and distribute threat intelligence. Feeds are generated every 6 hours.\n | \n
\n \n | \n RST Cloud Threat Intel Feed\n | \n \n Aggregated Indicators of Compromise collected and cross-verified from multiple open and community-supported sources, enriched and ranked using our intelligence platform.\n | \n
\n \n | \n Rutgers Blacklisted IPs\n | \n IP List of SSH Brute force attackers is created from a merged of locally observed IPs and 2 hours old IPs registered at badip.com and blocklist.de | \n
\n \n | \n SANS ICS Suspicious Domains\n | \n \n The Suspicious Domains Threat Lists by SANS ICS tracks suspicious domains. It offers 3 lists categorized as either high, medium or low sensitivity, where the high sensitivity list has fewer false positives, whereas the low sensitivity list with more false positives. There is also an approved whitelist of domains.
\n Finally, there is a suggested IP blocklist from DShield.\n | \n
\n \n | \n SecurityScorecard IoCs\n | \n \n Public access IoCs from technical blogs posts and reports by SecurityScorecard.\n | \n
\n \n | \n Stixify\n | \n \n Your automated threat intelligence analyst. Extract machine readable intelligence from unstructured data.\n | \n
\n \n | \n signature-base\n | \n \n A database of signatures used in other tools by Neo23x0.\n | \n
\n \n | \n The Spamhaus project\n | \n \n The Spamhaus Project contains multiple threatlists associated with spam and malware activity.\n | \n
\n \n | \n SophosLabs Intelix\n | \n \n SophosLabs Intelix is the threat intelligence platform that powers Sophos products and partners. You can access intelligence based on file hash, url etc. as well as submit samples for analysis. Through REST API's you can easily and quickly add this threat intelligence to your systems.\n | \n
\n \n | \n Spur\n | \n \n Spur provides tools and data to detect VPNs, Residential Proxies, and Bots. Free plan allows users to lookup an IP and get its classification, VPN provider, popular geolocations behind the IP, and some more useful context.\n | \n
\n \n | \n SSL Blacklist\n | \n \n SSL Blacklist (SSLBL) is a project maintained by abuse.ch. The goal is to provide a list of \"bad\" SSL certificates identified by abuse.ch to be associated with malware or botnet activities. SSLBL relies on SHA1 fingerprints of malicious SSL certificates and offers various blacklists\n | \n
\n \n | \n Statvoo Top 1 Million Sites\n | \n \n Probable Whitelist of the top 1 million web sites, as ranked by Statvoo.\n | \n
\n \n | \n Strongarm, by Percipient Networks\n | \n \n Strongarm is a DNS blackhole that takes action on indicators of compromise by blocking malware command and control. Strongarm aggregates free indicator feeds, integrates with commercial feeds, utilizes Percipient's IOC feeds, and operates DNS resolvers and APIs for you to use to protect your network and business. Strongarm is free for personal use.\n | \n
\n \n | \n SIEM Rules\n | \n \n Your detection engineering database. View, modify, and deploy SIEM rules for threat hunting and detection.\n | \n
\n \n | \n Talos\n | \n \n\t Cisco Talos Intelligence Group is one of the largest commercial threat intelligence teams in the world, comprised of world-class researchers, analysts and engineers. These teams are supported by unrivaled telemetry and sophisticated systems to create accurate, rapid and actionable threat intelligence for Cisco customers, products and services. Talos defends Cisco customers against known and emerging threats, discovers new vulnerabilities in common software, and interdicts threats in the wild before they can further harm the internet at large. Talos maintains the official rule sets of Snort.org, ClamAV, and SpamCop, in addition to releasing many open-source research and analysis tools. Talos provides an easy to use web UI to check an observable's reputation.\n | \n
\n \n | \n threatfeeds.io\n | \n \n threatfeeds.io lists free and open-source threat intelligence feeds and sources and provides direct download links and live summaries.\n | \n
\n \n | \n threatfox.abuse.ch\n | \n \n ThreatFox is a free platform from abuse.ch with the goal of sharing indicators of compromise (IOCs) associated with malware with the infosec community, AV vendors and threat intelligence providers.\n | \n
\n \n | \n Technical Blogs and Reports, by ThreatConnect\n | \n \n This source is being populated with the content from over 90 open source, security blogs. IOCs (Indicators of Compromise) are parsed out of each blog and the content of the blog is formatted in markdown.\n | \n
\n \n | \n Threat Jammer\n | \n \n Threat Jammer is a REST API service that allows developers, security engineers, and other IT professionals to access high-quality threat intelligence data from a variety of sources and integrate it into their applications with the sole purpose of detecting and blocking malicious activity.\n | \n
\n \n | \n ThreatMiner\n | \n \n ThreatMiner has been created to free analysts from data collection and to provide them a portal on which they can carry out their tasks, from reading reports to pivoting and data enrichment.\n The emphasis of ThreatMiner isn't just about indicators of compromise (IoC) but also to provide analysts with contextual information related to the IoC they are looking at.\n | \n
\n \n | \n WSTNPHX Malware Email Addresses\n | \n Email addresses used by malware collected by VVestron Phoronix (WSTNPHX) | \n
\n \n | \n UnderAttack.today\n | \n UnderAttack is a free intelligence platform, it shares IPs and information about suspicious events and attacks. Registration is free. | \n
\n \n | \n URLhaus\n | \n URLhaus is a project from abuse.ch with the goal of sharing malicious URLs that are being used for malware distribution. | \n
\n \n | \n VirusShare\n | \n \n VirusShare.com is a repository of malware samples to provide security researchers, incident responders, forensic analysts, and the morbidly curious access to samples of malicious code. Access to the site is granted via invitation only.\n | \n
\n \n | \n VulDB CTI\n | \n \n VulDB is a vulnerability database which associates actor activities and attack details with vulnerabilities. The predictive approach helps to determine emerging research and attack activities by malicious actors.\n | \n
\n \n | \n Yara-Rules\n | \n \n An open source repository with different Yara signatures that are compiled, classified and kept as up to date as possible.\n | \n
\n \n | \n 1st Dual Stack Threat Feed by MrLooquer\n | \n \nMrlooquer has created the first threat feed focused on systems with dual stack. Since IPv6 protocol has begun to be part of malware and fraud communications, It is necessary to detect and mitigate the threats in both protocols (IPv4 and IPv6).\n | \n
\n \n | \n Validin DNS Database\n | \n \n Free intelligence source for current and historical DNS information, finding other websites associated with certain IPs, and subdomain knowledge There is a free API for IP and domain intelligence as well. \n | \n
\n
\n\n## Formats\n\nStandardized formats for sharing Threat Intelligence (mostly IOCs).\n\n\n \n | \n AbuseHelper\n | \n \n AbuseHelper is an open-source framework for receiving and redistributing abuse feeds and threat intel.\n | \n
\n \n | \n AbuseIO\n | \n \n A toolkit to receive, process, correlate and notify end users about abuse reports, thereby consuming threat intelligence feeds.\n | \n
\n \n | \n AIS\n | \n \n The Cybersecurity and Infrastructure Security Agency (CISA) free Automated Indicator Sharing (AIS) capability enables the exchange of cyber threat indicators between the Federal Government and the private sector at machine speed. Threat indicators are pieces of information like malicious IP addresses or the sender address of a phishing email (although they can also be much more complicated).\n | \n
\n \n | \n Bearded Avenger\n | \n \n The fastest way to consume threat intelligence. Successor to CIF.\n | \n
\n \n | \n Blueliv Threat Exchange Network\n | \n \n Allows participants to share threat indicators with the community.\n | \n
\n \n | \n Cortex\n | \n \n Cortex allows observables, such as IPs, email addresses, URLs, domain names, files or hashes, to be analyzed one by one or in bulk mode using a single web interface. The web interface acts as a frontend for numerous analyzers, removing the need for integrating these yourself during analysis. Analysts can also use the Cortex REST API to automate parts of their analysis.\n | \n
\n \n | \n CRITS\n | \n \n CRITS is a platform that provides analysts with the means to conduct collaborative research into malware and threats. It plugs into a centralized intelligence data repository, but can also be used as a private instance.\n | \n
\n \n | \n CIF\n | \n \n The Collective Intelligence Framework (CIF) allows you to combine known malicious threat information from many sources and use that information for IR, detection and mitigation. Code available on GitHub.\n | \n
\n\n | \n CTIX\n | \n \n CTIX is a smart, client-server threat intelligence platform (TIP) for ingestion, enrichment, analysis, and bi-directional sharing of threat data within your trusted network.\n | \n
\n \n | \n EclecticIQ Platform\n | \n \n EclecticIQ Platform is a STIX/TAXII based Threat Intelligence Platform (TIP) that empowers threat analysts to perform faster, better, and deeper investigations while disseminating intelligence at machine-speed.\n | \n
\n \n | \n IntelMQ\n | \n \n IntelMQ is a solution for CERTs for collecting and processing security feeds, pastebins, tweets using a message queue protocol. It's a community driven initiative called IHAP (Incident Handling Automation Project) which was conceptually designed by European CERTs during several InfoSec events. Its main goal is to give to incident responders an easy way to collect & process threat intelligence thus improving the incident handling processes of CERTs.\n | \n
\n \n | \n IntelOwl\n | \n \n Intel Owl is an OSINT solution to get threat intelligence data about a specific file, an IP or a domain from a single API at scale. Intel Owl is composed of analyzers that can be run to retrieve data from external sources (like VirusTotal or AbuseIPDB) or to generate intel from internal analyzers (like Yara or Oletools). It can be integrated easily in your stack of security tools (pyintelowl) to automate common jobs usually performed, for instance, by SOC analysts manually.\n | \n
\n \n | \n Kaspersky Threat Intelligence Portal\n | \n \n A website that provides a knowledge base describing cyber threats, legitimate objects, and their relationships, brought together into a single web service. Subscribing to Kaspersky Lab’s Threat Intelligence Portal provides you with a single point of entry to four complementary services: Kaspersky Threat Data Feeds, Threat Intelligence Reporting, Kaspersky Threat Lookup and Kaspersky Research Sandbox, all available in human-readable and machine-readable formats.\n | \n
\n \n | \n Malstrom\n | \n \n Malstrom aims to be a repository for threat tracking and forensic artifacts, but also stores YARA rules and notes for investigation. Note: Github project has been archived (no new contributions accepted).\n | \n
\n \n | \n ManaTI\n | \n \n The ManaTI project assists threat analyst by employing machine learning techniques that find new relationships and inferences automatically.\n | \n
\n \n | \n MANTIS\n | \n \n The Model-based Analysis of Threat Intelligence Sources (MANTIS) Cyber Threat Intelligence Management Framework supports the management of cyber threat intelligence expressed in various standard languages, like STIX and CybOX. It is *not* ready for large-scale production though.\n | \n
\n \n | \n Megatron\n | \n \n Megatron is a tool implemented by CERT-SE which collects and analyses bad IPs, can be used to calculate statistics, convert and analyze log files and in abuse & incident handling.\n | \n
\n \n | \n MineMeld\n | \n \n An extensible Threat Intelligence processing framework created Palo Alto Networks.\n It can be used to manipulate lists of indicators and transform and/or aggregate them for consumption by third party enforcement infrastructure.\n | \n
\n \n | \n MISP\n | \n \n The Malware Information Sharing Platform (MISP) is an open source software solution for collecting, storing, distributing and sharing cyber security indicators and malware analysis.\n | \n
\n \n | \n n6\n | \n \n n6 (Network Security Incident eXchange) is a system to collect, manage and distribute security information on a large scale. Distribution is realized through a simple REST API and a web interface that authorized users can use to receive various types of data, in particular information on threats and incidents in their networks. It is developed by CERT Polska.\n | \n
\n \n | \n Open Cybersecurity Schema Framework (OCSF)\n | \n \n The Open Cybersecurity Schema Framework is an open-source project, delivering an extensible framework for developing schemas, along with a vendor-agnostic core security schema. Vendors and other data producers can adopt and extend the schema for their specific domains. Data engineers can map differing schemas to help security teams simplify data ingestion and normalization, so that data scientists and analysts can work with a common language for threat detection and investigation. The goal is to provide an open standard, adopted in any environment, application, or solution, while complementing existing security standards and processes.\n | \n
\n \n | \n OpenCTI\n | \n \n OpenCTI, the Open Cyber Threat Intelligence platform, allows organizations to manage their cyber threat intelligence knowledge and observables. Its goal is to structure, store, organize and visualize technical and non-technical information about cyber threats. Data is structured around a knowledge schema based on the STIX2 standards. OpenCTI can be integrated with other tools and platforms, including MISP, TheHive, and MITRE ATT&CK, a.o.\n | \n
\n \n | \n OpenIOC\n | \n \n OpenIOC is an open framework for sharing threat intelligence. It is designed to exchange threat information both internally and externally in a machine-digestible format.\n | \n
\n \n | \n OpenTAXII\n | \n \n OpenTAXII is a robust Python implementation of TAXII Services that delivers a rich feature set and a friendly Pythonic API built on top of a well designed application.\n | \n
\n \n | \n OSTrICa\n | \n \n An open source plugin-oriented framework to collect and visualize Threat Intelligence information.\n | \n
\n \n | \n OTX - Open Threat Exchange\n | \n \n AlienVault Open Threat Exchange (OTX) provides open access to a global community of threat researchers and security professionals. It delivers community-generated threat data, enables collaborative research, and automates the process of updating your security infrastructure with threat data from any source.\n | \n
\n \n | \n Open Threat Partner eXchange\n | \n \n The Open Threat Partner eXchange (OpenTPX) consists of an open-source format and tools for exchanging machine-readable threat intelligence and network security operations data. It is a JSON-based format that allows sharing of data between connected systems.\n | \n
\n \n | \n PassiveTotal\n | \n \n The PassiveTotal platform offered by RiskIQ is a threat-analysis platform which provides analysts with as much data as possible in order to prevent attacks before they happen. Several types of solutions are offered, as well as integrations (APIs) with other systems.\n | \n
\n \n | \n Pulsedive\n | \n \n Pulsedive is a free, community threat intelligence platform that is consuming open-source feeds, enriching the IOCs, and running them through a risk-scoring algorithm to improve the quality of the data. It allows users to submit, search, correlate, and update IOCs; lists \"risk factors\" for why IOCs are higher risk; and provides a high level view of threats and threat activity.\n | \n
\n \n | \n Recorded Future\n | \n \n Recorded Future is a premium SaaS product that automatically unifies threat intelligence from open, closed, and technical sources into a single solution. Their technology uses natural language processing (NLP) and machine learning to deliver that threat intelligence in real time — making Recorded Future a popular choice for IT security teams.\n | \n
\n \n | \n Scumblr\n | \n \n Scumblr is a web application that allows performing periodic syncs of data sources (such as Github repositories and URLs) and performing analysis (such as static analysis, dynamic checks, and metadata collection) on the identified results.\n Scumblr helps you streamline proactive security through an intelligent automation framework to help you identify, track, and resolve security issues faster.\n | \n
\n \n | \n STAXX (Anomali)\n | \n \n Anomali STAXX™ gives you a free, easy way to subscribe to any STIX/TAXII feed. Simply download the STAXX client, configure your data sources, and STAXX will handle the rest.\n | \n
\n \n | \n stoQ\n | \n \n stoQ is a framework that allows cyber analysts to organize and automate repetitive, data-driven tasks. It features plugins for many other systems to interact with.\n One use case is the extraction of IOCs from documents, an example of which is shown here, but it can also be used for deobfuscationg and decoding of content and automated scanning with YARA, for example.\n | \n
\n \n | \n TARDIS\n | \n \n The Threat Analysis, Reconnaissance, and Data Intelligence System (TARDIS) is an open source framework for performing historical searches using attack signatures.\n | \n
\n \n | \n ThreatConnect\n | \n \n ThreatConnect is a platform with threat intelligence, analytics, and orchestration capabilities. It is designed to help you collect data, produce intelligence, share it with others, and take action on it.\n | \n
\n \n | \n ThreatCrowd\n | \n \n ThreatCrowd is a system for finding and researching artefacts relating to cyber threats.\n | \n
\n \n | \n ThreatPipes\n | \n \n Stay two steps ahead of your adversaries. Get a complete picture of how they will exploit you.\n
\n ThreatPipes is a reconnaissance tool that automatically queries 100’s of data sources to gather intelligence on IP addresses, domain names, e-mail addresses, names and more.\n
\n You simply specify the target you want to investigate, pick which modules to enable and then ThreatPipes will collect data to build up an understanding of all the entities and how they relate to each other.\n | \n
\n \n | \n ThreatExchange\n | \n \n Facebook created ThreatExchange so that participating organizations can share threat data using a convenient, structured, and easy-to-use API that provides privacy controls to enable sharing with only desired groups. This project is still in beta. Reference code can be found at GitHub.\n | \n
\n \n | \n TypeDB CTI\n | \n \n\t\tTypeDB Data - CTI is an open source threat intelligence platform for organisations to store and manage their cyber threat intelligence (CTI) knowledge. It enables threat intel professionals to bring together their disparate CTI information into one database and find new insights about cyber threats. This repository provides a schema that is based on STIX2, and contains MITRE ATT&CK as an example dataset to start exploring this threat intelligence platform. More in this blog post.\n | \n
\n \n | \n VirusBay\n | \n \n VirusBay is a web-based, collaboration platform that connects security operations center (SOC) professionals with relevant malware researchers.\n | \n
\n \n | \n threatnote.io\n | \n \n The new and improved threatnote.io - A tool for CTI analysts and teams to manage intel requirements, reporting, and CTI processes in an all-in-one platform\n | \n
\n \n | \n XFE - X-Force Exchange\n | \n \n The X-Force Exchange (XFE) by IBM XFE is a free SaaS product that you can use to search for threat intelligence information, collect your findings, and share your insights with other members of the XFE community.\n | \n
\n \n | \n Yeti\n | \n \n The open, distributed, machine and analyst-friendly threat intelligence repository. Made by and for incident responders.\n | \n
\n
\n\n\n\n## Tools\n\nAll kinds of tools for parsing, creating and editing Threat Intelligence. Mostly IOC based.\n\n\n \n | \n ActorTrackr\n | \n \n ActorTrackr is an open source web application for storing/searching/linking actor related data. The primary sources are from users and various public repositories. Source available on GitHub.\n | \n
\n \n | \n AIEngine\n | \n \n AIEngine is a next generation interactive/programmable Python/Ruby/Java/Lua packet inspection engine with capabilities of learning without any human intervention, NIDS(Network Intrusion Detection System) functionality, DNS domain classification, network collector, network forensics and many others.\n | \n
\n \n | \n AIOCRIOC\n | \n \n Artificial Intelligence Ocular Character Recognition Indicator of Compromise (AIOCRIOC) is a tool that combines web scraping, the OCR capabilities of Tesseract and OpenAI compatible LLM API's such as GPT-4 to parse and extract IOCs from reports and other web content including embedded images with contextual data.\n | \n
\n \n | \n Analyze (Intezer)\n | \n \n Analyze is an all-in-one malware analysis platform that is able to perform static, dynamic, and genetic code analysis on all types of files. Users can track malware families, extract IOCs/MITRE TTPs, and download YARA signatures. There is a community edition to get started for free.\n | \n
\n \n | \n Automater\n | \n \n Automater is a URL/Domain, IP Address, and Md5 Hash OSINT tool aimed at making the analysis process easier for intrusion Analysts.\n | \n
\n \n | \n BlueBox\n | \n \n BlueBox is an OSINT solution to get threat intelligence data about a specific file, an IP, a domain or URL and analyze them.\n | \n
\n \n | \n BotScout\n | \n \n BotScout helps prevent automated web scripts, known as \"bots\", from registering on forums, polluting databases, spreading spam, and abusing forms on web sites.\n | \n
\n \n | \n bro-intel-generator\n | \n \n Script for generating Bro intel files from pdf or html reports.\n | \n
\n \n | \n cabby\n | \n \n A simple Python library for interacting with TAXII servers.\n | \n
\n \n | \n cacador\n | \n \n Cacador is a tool written in Go for extracting common indicators of compromise from a block of text.\n | \n
\n \n | \n Combine\n | \n \n Combine gathers Threat Intelligence Feeds from publicly available sources.\n | \n
\n \n | \n CrowdFMS\n | \n \n CrowdFMS is a framework for automating collection and processing of samples from VirusTotal, by leveraging the Private API system.\n The framework automatically downloads recent samples, which triggered an alert on the users YARA notification feed.\n | \n
\n \n | \n CTI-Transmute\n | \n \n CTI-Transmute is a tool for converting Cyber Threat Intelligence (CTI) data between MISP and STIX formats. It provides a set of API endpoints that allow automated conversion of data, making it easier to integrate different threat intelligence platforms and workflows. Source available on GitHub.\n | \n
\n \n | \n Cuckoo Sandbox\n | \n \n Cuckoo Sandbox is an automated dynamic malware analysis system. It's the most well-known open source malware analysis sandbox around and is frequently deployed by researchers, CERT/SOC teams, and threat intelligence teams all around the globe. For many organizations Cuckoo Sandbox provides a first insight into potential malware samples.\n | \n
\n \n | \n CyberGordon\n | \n \n CyberGordon is a threat intelligence search engine. It leverages 30+ sources.\n | \n
\n \n | \n CyBot\n | \n \n CyBot is a threat intelligence chat bot. It can perform several types of lookups offered by custom modules.\n | \n
\n \n | \n Fenrir\n | \n \n Simple Bash IOC Scanner.\n | \n
\n \n | \n FireHOL IP Aggregator\n | \n \n Application for keeping feeds from FireHOL blocklist-ipsets with IP addresses appearance history. HTTP-based API service is developed for search requests.\n | \n
\n \n | \n Forager\n | \n \n Multithreaded threat intelligence hunter-gatherer script.\n | \n
\n \n | \n Gigasheet\n | \n \n Gigasheet is a SaaS product used to analyze massive, and disparate cybersecurity data sets. Import massive log files, netflow, pcaps, big CSVs and more.\n | \n
\n \n | \n GoatRider\n | \n \n GoatRider is a simple tool that will dynamically pull down Artillery Threat Intelligence Feeds, TOR, AlienVaults OTX, and the Alexa top 1 million websites and do a comparison to a hostname file or IP file.\n | \n
\n \n | \n Google APT Search Engine\n | \n \n APT Groups, Operations and Malware Search Engine. The sources used for this Google Custom Search are listed on this GitHub gist.\n | \n
\n \n | \n GOSINT\n | \n \n The GOSINT framework is a free project used for collecting, processing, and exporting high quality public indicators of compromise (IOCs).\n | \n
\n \n | \n hashdd\n | \n \n A tool to lookup related information from crytographic hash value\n | \n
\n \n | \n Harbinger Threat Intelligence\n | \n \n Python script that allows to query multiple online threat aggregators from a single interface.\n | \n
\n \n | \n Hippocampe\n | \n \n Hippocampe aggregates threat feeds from the Internet in an Elasticsearch cluster. It has a REST API which allows to search into its 'memory'. It is based on a Python script which fetchs URLs corresponding to feeds, parses and indexes them.\n | \n
\n \n | \n Hiryu\n | \n \n A tool to organize APT campaign information and to visualize relations between IOCs.\n | \n
\n \n | \n IOC Editor\n | \n \n A free editor for Indicators of Compromise (IOCs).\n | \n
\n \n | \n IOC Finder\n | \n \n Python library for finding indicators of compromise in text. Uses grammars rather than regexes for improved comprehensibility. As of February, 2019, it parses over 18 indicator types.\n | \n
\n \n | \n IOC Fanger (and Defanger)\n | \n \n Python library for fanging (`hXXp://example[.]com` => `http://example.com`) and defanging (`http://example.com` => `hXXp://example[.]com`) indicators of compromise in text.\n | \n
\n \n | \n ioc_parser\n | \n \n Tool to extract indicators of compromise from security reports in PDF format.\n | \n
\n \n | \n ioc_writer\n | \n \n Provides a Python library that allows for basic creation and editing of OpenIOC objects.\n | \n
\n \n | \n iocextract\n | \n \n Extracts URLs, IP addresses, MD5/SHA hashes, email addresses, and YARA rules from text corpora. Includes some encoded and “defanged” IOCs in the output, and optionally decodes/refangs them.\n | \n
\n \n | \n IOCextractor\n | \n \n IOC (Indicator of Compromise) Extractor is a program to help extract IOCs from text files. The general goal is to speed up the process of parsing structured data (IOCs) from unstructured or semi-structured data\n | \n
\n \n | \n ibmxforceex.checker.py\n | \n \n Python client for the IBM X-Force Exchange.\n | \n
\n \n | \n jager\n | \n \n Jager is a tool for pulling useful IOCs (indicators of compromise) out of various input sources (PDFs for now, plain text really soon, webpages eventually) and putting them into an easy to manipulate JSON format.\n | \n
\n \n | \n Kaspersky CyberTrace\n | \n \n Threat intelligence fusion and analysis tool that integrates threat data feeds with SIEM solutions. Users can immediately leverage threat intelligence for security monitoring and incident report (IR) activities in the workflow of their existing security operations.\n | \n
\n \n | \n KLara\n | \n \n KLara, a distributed system written in Python, allows researchers to scan one or more Yara rules over collections with samples, getting notifications by e-mail as well as the web interface when scan results are ready.\n | \n
\n \n | \n libtaxii\n | \n \n A Python library for handling TAXII Messages invoking TAXII Services.\n | \n
\n \n | \n Loki\n | \n \n Simple IOC and Incident Response Scanner.\n | \n
\n \n | \n LookUp\n | \n \n LookUp is a centralized page to get various threat information about an IP address. It can be integrated easily into context menus of tools like SIEMs and other investigative tools.\n | \n
\n \n | \n Machinae\n | \n \n Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints.\n | \n
\n \n | \n MalPipe\n | \n \n Amodular malware (and indicator) collection and processing framework. It is designed to pull malware, domains, URLs and IP addresses from multiple feeds, enrich the collected data and export the results.\n | \n
\n \n | \n MISP Workbench\n | \n \n Tools to export data out of the MISP MySQL database and use and abuse them outside of this platform.\n | \n
\n \n | \n MISP-Taxii-Server\n | \n \n A set of configuration files to use with EclecticIQ's OpenTAXII implementation, along with a callback for when data is sent to the TAXII Server's inbox.\n | \n
\n \n | \n MSTIC Jupyter and Python Security Tools\n | \n \n msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. \n | \n
\n \n | \n nyx\n | \n \n The goal of this project is to facilitate distribution of Threat Intelligence artifacts to defensive systems and to enhance the value derived from both open source and commercial tools.\n | \n
\n \n | \n OneMillion\n | \n \n Python library to determine if a domain is in the Alexa or Cisco top, one million domain lists.\n | \n
\n \n | \n openioc-to-stix\n | \n \n Generate STIX XML from OpenIOC XML.\n | \n
\n \n | \n Omnibus\n | \n \n Omnibus is an interactive command line application for collecting and managing IOCs/artifacts (IPs, Domains, Email Addresses, Usernames, and Bitcoin Addresses), enriching these artifacts with OSINT data from public sources, and providing the means to store and access these artifacts in a simple way.\n | \n
\n \n | \n OSTIP\n | \n \n A homebrew threat data platform.\n | \n
\n \n | \n poortego\n | \n \n Open-source project to handle the storage and linking of open-source intelligence (ala Maltego, but free as in beer and not tied to a specific / proprietary database). Originally developed in ruby, but new codebase completely rewritten in python.\n | \n
\n \n | \n PyIOCe\n | \n \n PyIOCe is an IOC editor written in Python.\n | \n
\n \n | \n QRadio\n | \n \n QRadio is a tool/framework designed to consolidate cyber threats intelligence sources.\n The goal of the project is to establish a robust modular framework for extraction of intelligence data from vetted sources.\n | \n
\n \n | \n rastrea2r\n | \n \n Collecting & Hunting for Indicators of Compromise (IOC) with gusto and style!\n | \n
\n \n | \n Redline\n | \n \n A host investigations tool that can be used for, amongst others, IOC analysis.\n | \n
\n \n | \n RITA\n | \n \n Real Intelligence Threat Analytics (RITA) is intended to help in the search for indicators of compromise in enterprise networks of varying size.\n | \n
\n \n | \n Softrace\n | \n \n Lightweight National Software Reference Library RDS storage.\n | \n
\n \n | \n sqhunter\n | \n \n Threat hunter based on osquery, Salt Open and Cymon API. It can query open network sockets and check them against threat intelligence sources\n | \n
\n \n | \n SRA TAXII2 Server\n | \n \n Full TAXII 2.0 specification server implemented in Node JS with MongoDB backend.\n | \n
\n \n | \n Stixvalidator.com\n | \n \n Stixvalidator.com is an online free STIX and STIX2 validator service.\n | \n
\n \n | \n Stixview\n | \n \n Stixview is a JS library for embeddable interactive STIX2 graphs.\n | \n
\n\t\n | \n stix-viz\n | \n \n STIX Visualization Tool.\n | \n
\n \n | \n TAXII Test Server\n | \n \n Allows you to test your TAXII environment by connecting to the provided services and performing the different functions as written in the TAXII specifications.\n | \n
\n \n | \n threataggregator\n | \n \n ThreatAggregrator aggregates security threats from a number of online sources, and outputs to various formats, including CEF, Snort and IPTables rules.\n | \n
\n \n | \n threatcrowd_api\n | \n \n Python Library for ThreatCrowd's API.\n | \n
\n \n | \n threatcmd\n | \n \n Cli interface to ThreatCrowd.\n | \n
\n \n | \n Threatelligence\n | \n \n Threatelligence is a simple cyber threat intelligence feed collector, using Elasticsearch, Kibana and Python to automatically collect intelligence from custom or public sources. Automatically updates feeds and tries to further enhance data for dashboards. Projects seem to be no longer maintained, however.\n | \n
\n \n | \n ThreatIngestor\n | \n \n Flexible, configuration-driven, extensible framework for consuming threat intelligence. ThreatIngestor can watch Twitter, RSS feeds, and other sources, extract meaningful information like C2 IPs/domains and YARA signatures, and send that information to other systems for analysis.\n | \n
\n \n | \n ThreatPinch Lookup\n | \n \n An extension for Chrome that creates hover popups on every page for IPv4, MD5, SHA2, and CVEs. It can be used for lookups during threat investigations.\n | \n
\n \n | \n ThreatTracker\n | \n \n A Python script designed to monitor and generate alerts on given sets of IOCs indexed by a set of Google Custom Search Engines.\n | \n
\n \n | \n threat_intel\n | \n \n Several APIs for Threat Intelligence integrated in a single package. Included are: OpenDNS Investigate, VirusTotal and ShadowServer.\n | \n
\n \n | \n Threat-Intelligence-Hunter\n | \n \n TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own local database of indicators.\n | \n
\n \n | \n tiq-test\n | \n \n The Threat Intelligence Quotient (TIQ) Test tool provides visualization and statistical analysis of TI feeds.\n | \n
\n \n | \n YETI\n | \n \n YETI is a proof-of-concept implementation of TAXII that supports the Inbox, Poll and Discovery services defined by the TAXII Services Specification.\n | \n
\n
\n\n\n\n## \n \n | \n APT & Cyber Criminal Campaign Collection\n | \n \n Extensive collection of (historic) campaigns. Entries come from various sources.\n | \n
\n \n | \n APTnotes\n | \n \n A great collection of sources regarding Advanced Persistent Threats (APTs). These reports usually include strategic and tactical knowledge or advice.\n | \n
\n \n | \n ATT&CK\n | \n \n Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) is a model and framework for describing the actions an adversary may take while operating within an enterprise network. ATT&CK is a constantly growing common reference for post-access techniques that brings greater awareness of what actions may be seen during a network intrusion. MITRE is actively working on integrating with related construct, such as CAPEC, STIX and MAEC.\n | \n
\n \n | \n Building Threat Hunting Strategies with the Diamond Model\n | \n \n Blogpost by Sergio Caltagirone on how to develop intelligent threat hunting strategies by using the Diamond Model.\n | \n
\n \n | \n Cyber Analytics Repository by MITRE\n | \n \n The Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by MITRE based on the Adversary Tactics, Techniques, and Common Knowledge (ATT&CK™) threat model.\n | \n
\n \n | \n Cyber Threat Intelligence Capability Maturity Model (CTI-CMM)\n | \n \n A new Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) using a stakeholder-first approach and aligned with the Cybersecurity Capability Maturity Model (C2M2) to empower your team and create lasting value.\n | \n
\n \n | \n Cyber Threat Intelligence Repository by MITRE\n | \n \n The Cyber Threat Intelligence Repository of ATT&CK and CAPEC catalogs expressed in STIX 2.0 JSON.\n | \n
\n \n | \n Cyber Threat Intelligence: A Product Without a Process?\n | \n \n A research paper describing how current cyber threat intelligence products fall short and how they can be improved by introducing and evaluating sound methodologies and processes.\n | \n
\n \n | \n Definitive Guide to Cyber Threat Intelligence\n | \n \n Describes the elements of cyber threat intelligence and discusses how it is collected, analyzed, and used by a variety of human and technology consumers. Further examines how intelligence can improve cybersecurity at tactical, operational, and strategic levels, and how it can help you stop attacks sooner, improve your defenses, and talk more productively about cybersecurity issues with executive management in typical for Dummies style.\n | \n
\n \n | \n The Detection Maturity Level (DML)\n | \n \n The DML model is a capability maturity model for referencing ones maturity in detecting cyber attacks.\n It's designed for organizations who perform intel-driven detection and response and who put an emphasis on having a mature detection program.\n The maturity of an organization is not measured by it's ability to merely obtain relevant intelligence, but rather it's capacity to apply that intelligence effectively to detection and response functions.\n | \n
\n \n | \n The Diamond Model of Intrusion Analysis\n | \n \n This paper presents the Diamond Model, a cognitive framework and analytic instrument to support and improve intrusion analysis. Supporting increased measurability, testability and repeatability in intrusion analysis in order to attain higher effectivity, efficiency and accuracy in defeating adversaries is one of its main contributions.\n | \n
\n \n | \n The Targeting Process: D3A and F3EAD\n | \n \n F3EAD is a military methodology for combining operations and intelligence.\n | \n
\n \n | \n Guide to Cyber Threat Information Sharing by NIST\n | \n \n The Guide to Cyber Threat Information Sharing (NIST Special Publication 800-150) assists organizations in establishing computer security incident response capabilities that leverage the collective knowledge, experience, and abilities of their partners by actively sharing threat intelligence and ongoing coordination. The guide provides guidelines for coordinated incident handling, including producing and consuming data, participating in information sharing communities, and protecting incident-related data.\n | \n
\n \n | \n Intelligence Preparation of the Battlefield/Battlespace\n | \n \n This publication discusses intelligence preparation of the battlespace (IPB) as a critical component of the military decision making and planning process and how IPB supports decision making, as well as integrating processes and continuing activities.\n | \n
\n \n | \n Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains\n | \n \n The intrusion kill chain as presented in this paper provides one with a structured approach to intrusion analysis, indicator extraction and performing defensive actions.\n | \n
\n \n | \n ISAO Standards Organization\n | \n \n The ISAO Standards Organization is a non-governmental organization established on October 1, 2015. Its mission is to improve the Nation’s cybersecurity posture by identifying standards and guidelines for robust and effective information sharing related to cybersecurity risks, incidents, and best practices.\n | \n
\n \n | \n Joint Publication 2-0: Joint Intelligence\n | \n \n This publication by the U.S army forms the core of joint intelligence doctrine and lays the foundation to fully integrate operations, plans and intelligence into a cohesive team. The concepts presented are applicable to (Cyber) Threat Intelligence too.\n | \n
\n \n | \n Microsoft Research Paper\n | \n \n A framework for cybersecurity information sharing and risk reduction. A high level overview paper by Microsoft.\n | \n
\n \n | \n MISP Core Format (draft)\n | \n \n This document describes the MISP core format used to exchange indicators and threat information between MISP (Malware Information and threat Sharing Platform) instances.\n | \n
\n \n | \n NECOMA Project\n | \n \n The Nippon-European Cyberdefense-Oriented Multilayer threat Analysis (NECOMA) research project is aimed at improving threat data collection and analysis to develop and demonstratie new cyberdefense mechanisms.\n As part of the project several publications and software projects have been published.\n | \n
\n \n | \n Pyramid of Pain\n | \n \n The Pyramid of Pain is a graphical way to express the difficulty of obtaining different levels of indicators and the amount of resources adversaries have to expend when obtained by defenders.\n | \n
\n \n | \n Structured Analytic Techniques For Intelligence Analysis\n | \n \n This book contains methods that represent the most current best practices in intelligence, law enforcement, homeland security, and business analysis.\n | \n
\n \n | \n Threat Intelligence: Collecting, Analysing, Evaluating\n | \n \n This report by MWR InfoSecurity clearly describes several different types of threat intelligence, including strategic, tactical and operational variations. It also discusses the processes of requirements elicitation, collection, analysis, production and evaluation of threat intelligence. Also included are some quick wins and a maturity model for each of the types of threat intelligence defined by MWR InfoSecurity.\n | \n
\n \n | \n Threat Intelligence Sharing Platforms: An Exploratory Study of Software Vendors and Research Perspectives\n | \n \n A systematic study of 22 Threat Intelligence Sharing Platforms (TISP) surfacing eight key findings about the current state of threat intelligence usage, its definition and TISPs.\n | \n
\n \n | \n Traffic Light Protocol\n | \n \n The Traffic Light Protocol (TLP) is a set of designations used to ensure that sensitive information is shared with the correct audience. It employs four colors to indicate different degrees of sensitivity and the corresponding sharing considerations to be applied by the recipient(s).\n | \n
\n \n | \n Unit42 Playbook Viewer\n | \n \n The goal of the Playbook is to organize the tools, techniques, and procedures that an adversary uses into a structured format, which can be shared with others, and built upon. The frameworks used to structure and share the adversary playbooks are MITRE's ATT&CK Framework and STIX 2.0\n | \n
\n \n | \n Who's Using Cyberthreat Intelligence and How?\n | \n \n A whitepaper by the SANS Institute describing the usage of Threat Intelligence including a survey that was performed.\n | \n
\n \n | \n WOMBAT Project\n | \n \n The WOMBAT project aims at providing new means to understand the existing and emerging threats that are targeting the Internet economy and the net citizens. To reach this goal, the proposal includes three key workpackages: (i) real time gathering of a diverse set of security related raw data, (ii) enrichment of this input by means of various analysis techniques, and (iii) root cause identification and understanding of the phenomena under scrutiny.\n | \n
\n
\n\n\n\n## License\n\nLicensed under [Apache License 2.0](LICENSE).\n"
},
{
"path": "README_ch.md",
"content": "# 威胁情报大合集\n\n最好的威胁情报资源的精选列表\n\n威胁情报的简明定义：基于证据的知识，包括上下文、机制、指标、影响与和可行的建议，关于现有或新出现对资产的威胁或风险，可被用来告知有关威胁响应的决定\n\n提交前请查看 [contribute](CONTRIBUTING.md).\n\n- [威胁情报大合集](#威胁情报大合集)\n - [资源](#资源)\n - [格式](#格式)\n - [框架与平台](#框架与平台)\n - [工具](#工具)\n - [研究、标准、书籍](#研究标准书籍)\n - [许可证](#许可证)\n\n\n## 资源\n\n下面列表中提到的大多数资源/API 都是用来获得最新的威胁情报信息。\n有些人不认为这些资源可以当成威胁情报。但是对基于特定域或特定业务的真实威胁情报进行分析是很必要的。\n\n \n | \n AbuseIPDB\n | \n \n AbuseIPDB 是一个致力于帮助打击黑客、垃圾邮件发送者与互联网滥用的项目。为网站管理员、系统管理员和其他各方提供中心黑名单，提交查找与恶意活动相关的 IP 地址来帮助网络更加安全\n | \n
\n \n | \n Alexa Top 1 Million sites\n | \n \n 亚马逊提供的 Alexa TOP 100 万排名的网站。永远不要将它作为白名单使用\n | \n
\n \n | \n APT Groups and Operations\n | \n \n 一个包含有 APT 组织信息、行动和策略的表格\n | \n
\n \n | \n Binary Defense IP Banlist\n | \n \n Binary Defense 的威胁情报订阅源和 IP 黑名单列表\n | \n
\n \n | \n BGP Ranking\n | \n \n 提供恶意内容最多的 ASN 排名\n | \n
\n \n | \n Botnet Tracker\n | \n \n 对一些活跃的僵尸网络跟踪\n | \n
\n \n | \n BOTVRIJ.EU\n | \n \n Botvrij.eu 提供了不同种类的开源 IOC，可以在安全设备中使用来检测潜在的恶意活动\n | \n
\n \n | \n BruteForceBlocker\n | \n \n BruteForceBlocker 是一个旨在监视服务器上 sshd 日志来阻止暴力破解攻击的 perl 脚本，可以自动配置防火墙阻止规则并且提交恶意 IP 到项目地址, http://danger.rulez.sk/projects/bruteforceblocker/blist.php.\n | \n
\n \n | \n C&C Tracker\n | \n \n Bambenek Consulting 提供的活动 C&C 服务器的 IP 地址跟踪\n | \n
\n \n | \n CertStream\n | \n \n 实时证书透明度日志更新流，可以实时查询可能存在问题的证书\n | \n
\n \n | \n CCSS Forum Malware Certificates\n | \n \n 论坛报告的数字证书列表，列出那些潜在与恶意软件相关的各种证书颁发机构，此信息旨在防止公司根据数字证书判断恶意软件合法，并鼓励其撤销对此类证书的信任\n | \n
\n \n | \n CI Army List\n | \n \n 商业列表 CINS Score 的子集，聚焦于提供那些其他情报列表重没有的恶意IP地址\n | \n
\n \n | \n Cisco Umbrella\n | \n \n Cisco Umbrella 提供的其 DNS 解析前一百万站点的白名单\n | \n
\n \n | \n Cloudmersive Virus Scan\n | \n \n Cloudmersive 服务 API，支持扫描文件、URL 与云存储。百万级威胁检测规则持续更新，扫描性能很高。无需付费，只需要注册账号获取用户 API Key 即可\n | \n
\n \n | \n Critical Stack Intel\n | \n \n 由 Critical Stack 提供的免费威胁情报解析与聚合工具，可以应用到任何 Bro 生产系统中。也可以指定你信任的情报来源或能提取情报的来源，可能 https://developer.capitalone.com/resources/open-source 是可用的\n | \n
\n \n | \n CrowdSec Console\n | \n \n 最大的众包CTI，近乎实时地更新，这要归功于CrowdSec--一个新一代的、开源的、免费的、协作的IDS/IPS软件. CrowdSec 能够分析访问者的行为并对各种攻击提供适当的响应。用户可以与社区共享有关威胁的警报，并从网络效应中受益。 IP 地址是从真实攻击中收集的，并非完全来自 Honey Pot 网络. 用户可以与社区分享有关威胁的警报，并从网络效应中受益. IP 地址是从真实攻击中收集的，并非完全来自蜜罐网络.\n | \n
\n \n | \n Cyber Cure free intelligience feeds\n | \n \n CyberCure 提供的免费网络威胁情报源，其中包括当前正在互联网上受到感染和攻击的 IP 地址列表。恶意软件使用的 URL 列表以及当前正在传播的已知恶意软件的文件哈希值。CyberCure 使用传感器以低误报收集情报，细节请看文档\n | \n
\n \n | \n Cyware Threat Intelligence Feeds\n | \n \n Cyware 提供的威胁情报订阅源，为用户提供各种可信来源的威胁情报数据，整合有价值的、可运营的威胁情报。该威胁情报数据源与 STIX 1.x 和 STIX 2.0 完全兼容，可以为用户实时提供最新的全球恶意软件哈希、IP 和域名\n | \n
\n \n | \n DataPlane.org\n | \n \n DataPlane.org 是社区驱动的互联网数据、订阅和测量资源的提供方。免费提供可靠与值得信赖的服务\n | \n
\n \n | \n Focsec.com\n | \n \n Focsec.com 对外提供检测 VPN、代理、机器人和 TOR 请求的 API。使用该 API 有助于检测可疑登录、欺诈和滥用行为，具体示例代码可以在文档中找到\n | \n
\n \n | \n DigitalSide Threat-Intel\n | \n \n 开源网络威胁情报指标集合，基于恶意软件分析的 URL、IP 和域名。该项目的目的是开发和测试寻找、分析、收集与共享相关 IOC 指标的新方法，以便 SOC/CSIRT/CERT/个人尽可能地方便。报告以三种方式共享： STIX2 ， CSV 和 MISP Feed 。报告也发布在GitHub中\n | \n
\n \n | \n Disposable Email Domains\n | \n \n 常用于垃圾邮件/滥用服务的匿名或一次性电子邮件域名的集合\n | \n
\n \n | \n DNSTrails\n | \n \n 提供当前和历史 DNS 信息、WHOIS 信息，子域名信息，还提供了一个 IP 与域名情报的 API\n | \n
\n \n | \n Emerging Threats Firewall Rules\n | \n \n 不同类型防火墙的规则集，包括 iptables、PF 和 PIX\n | \n
\n \n | \n Emerging Threats IDS Rules\n | \n \n 用于报警或拦截的 Snort 和 Suricata 规则集\n | \n
\n \n | \n ExoneraTor\n | \n \n ExoneraTor 提供 Tor 网络中一部分 IP 地址的数据库，可以响应给定的 IP 地址在给定的时间是否作为 Tor 节点运行过\n | \n
\n \n | \n Exploitalert\n | \n \n 最新的 exploits 列表\n | \n
\n \n | \n FastIntercept\n | \n \n\t Intercept Security 依托其在全球的蜜网提供免费的 IP 信誉列表\n | \n
\n \n | \n ZeuS Tracker\n | \n \n Feodo Tracker abuse.ch 跟踪 Feodo 木马\n | \n
\n \n | \n FireHOL IP Lists\n | \n \n 超过 400 个公开可用的 IP 订阅，可以用来分析其演化、地理位置、时长、保留策略、重叠，这个网站侧重于网络犯罪（攻击、滥用、恶意软件）\n | \n
\n \n | \n FraudGuard\n | \n \n FraudGuard 提供了一个验证不断收集、分析实时网络流量的工具的服务\n | \n
\n \n | \n Grey Noise\n | \n \n Grey Noise 是一个收集、分析互联网范围内扫描器的系统，收集良性扫描器（如 Shodan.io）以及恶意扫描（如 SSH 和远程登录蠕虫）的数据\n | \n
\n \n | \n Hail a TAXII\n | \n \n Hail a TAXII.com 是一个 STIX 格式的开源网络威胁情报库，包括多种不同的格式，例如 Emerging Threats rules 与 PhishTank\n | \n
\n \n | \n HoneyDB\n | \n \n HoneyDB 提供蜜罐活动的实时数据，这些数据来自在互联网中部署的 HoneyPy 蜜罐。此外，HoneyDB 还提供对所收集的蜜罐活动的 API 访问，其中还包括各种来自蜜罐相关的 Twitter 推送的聚合\n | \n
\n \n | \n Icewater\n | \n \n 由 Icewater 提供的 12805 条免费的 Yara 规则\n | \n
\n \n | \n Infosec - CERT-PA\n | \n \n 恶意软件样本的收集与分析、黑名单漏洞数据库等其他服务。由 CERT-PA 创建并管理\n | \n
\n \n | \n InQuest Labs\n | \n \n 一个开放、交互式的、由 API 驱动的，面向安全研究人员的数据门户。可以搜索大量的文件样本，聚合了文件的信誉信息以及从公共资源中提取的 IOC 指标。使用工具来增强 Yara 开发、生成触发器、处理大小写混合的十六进制并生成与 base64 兼容的正则表达式\n | \n
\n \n | \n I-Blocklist\n | \n \n I-Blocklist 维护包括 IP 地址在内的多种类型的列表，主要有国家、ISP 和组织。其他列表包括 Web 攻击、Tor、间谍软件、代理，许多都可以免费使用，并且有多种格式\n | \n
\n \n | \n IPsum\n | \n \n IPsum 是一个威胁情报源，基于 30 多个不同的、公开的可疑或恶意的 IP 地址列表。 每天自动检索并解析所有列表，并将最终结果推送到此存储库。列表由 IP 地址和出现的总数组成。 由 Miroslav Stampar 创建并管理\n | \n
\n \n\t | \n James Brine Threat Intelligence Feeds\n | \n \n\t\t JamesBrine 通过云上和私有服务器上的蜜罐跟踪恶意 IP 地址，提供包括 SSH、FTP、RDP、GIT、SNMP 和 REDIS 在内的每日更新威胁情报。IOC 以 STIX2 格式提供，其披露的域名在钓鱼活动中很常见\n | \n
\n \n | \n Kaspersky Threat Data Feeds\n | \n \n 持续更新并告知您的企业或客户与网络威胁相关的风险和影响。实时数据可帮助您更有效地缓解威胁，甚至在攻击发起之前就防御攻击。与商业数据相比，演示数据订阅只包含部分 IoC（最多 1%）\n | \n
\n \n | \n Maldatabase\n | \n \n Maldatabase 旨在帮助恶意软件数据科学与威胁情报订阅。提供的数据包含样本通信的域名、执行的进程列表与释放的文件等其他信息。 这些源可以帮助您改进监控与安全工具。安全研究人员与学生都可以免费获得服务。\n | \n
\n \n | \n Malpedia\n | \n \n Malpedia 的主要目标是在调查恶意软件时提供快速识别和可用的上下文。\n | \n
\n \n | \n MalShare.com\n | \n \n MalShare 项目为研究人员提供一个公开的样本库\n | \n
\n \n | \n Maltiverse\n | \n \n Maltiverse 项目是一个庞大而丰富的 IoC 数据库，可以进行复杂的查询和聚合以调查恶意软件的活动及其基础设施。也提供了一个很棒的 IoC 批量查询服务\n | \n
\n \n | \n MalwareBazaar\n | \n \n MalwareBazaar 是一个来自 abuse.ch 的项目，其目标是与社区、反病毒供应商和威胁情报提供商共享恶意软件样本\n | \n
\n \n | \n Malware Domain List\n | \n \n 可搜索的恶意网站列表，反向查询出注册人信息，重点关注网络钓鱼、木马和漏洞利用工具包\n | \n
\n \n | \n Malware Patrol\n | \n \n Malware Patrol 为各种规模的公司提供黑名单列表、数据订阅和威胁情报。该公司精于网络威胁情报，重视情报的质量而非情报的数量，确保情报的质量是第一要务。\n | \n
\n \n | \n Malware-Traffic-Analysis.net\n | \n \n 该博客重点介绍与恶意软件相关的网络流量，包含流量分析练习题、教程、恶意软件样本、网络流量 pcap 文件以及技术分析报告\n | \n
\n \n | \n MalwareDomains.com\n | \n \n DNS-BH 项目创建并维护了一个传播恶意软件以及间谍软件的域名列表，可以被用来检测 DNS 请求做预防检测\n | \n
\n\t\n | \n MetaDefender Cloud\n | \n \n MetaDefender 云威胁情报源包含最新的恶意软件哈希签名，包括 MD5 和 SHA1，SHA256。是过去 24 MetaDefender 云发现的新的恶意哈希值。定语提供每日更新及恶意软件的检测和报告，提供可操作、及时的威胁情报\n | \n
\n \n | Netlab OpenData Project\n | \n \n Netlab OpenData 于 2016.8.16 在 ISC 2016 上首次发布，提供多种数据源，包括 DGA、EK、MalCon、Mirai C2、Mirai-Scanner、Hajime-Scanner 和 DRDoS 反射器\n | \n
\n \n | \n NoThink!\n | \n \n 来自 Matteo Cantoni 蜜罐提供的 SNMP、SSH、Telnet 黑名单 IP\n | \n
\n \n | \n NormShield Services\n | \n \n NormShield Services 提供了数千个潜在网络钓鱼攻击的域名信息（包括 whois 信息），免费注册公共服务以进行持续监控\n | \n
\n \n | \n NovaSense Threats\n | \n \n NovaSense 是 Snapt 的威胁情报中心，提供用于先发制人的威胁防护和缓解攻击的工具。NovaSense 保护各种规模的客户免受攻击者的侵害\n | \n
\n \n | \n Obstracts\n | \n \n 网络安全团队的 RSS 阅读器，能够将任何博客转变为结构化和可运营的威胁情报\n | \n
\n \n | \n OpenPhish Feeds\n | \n \n OpenPhish 接收来自多个流的 URL，然后使用其专有的网络钓鱼检测算法进行检测。有免费以及商业两个版本\n | \n
\n \n | \n 0xSI_f33d\n | \n \n 检测钓鱼域名、恶意软件域名、Portuguese 黑名单 IP 的免费服务\n | \n
\n \n | \n PhishTank\n | \n \n PhishTank 提供了可疑钓鱼网站的 URL，它们的数据来自各个报告的人，它们也在外部订阅中获得数据，这是一项免费服务，但有时需要 API key\n | \n
\n \n | \n PickupSTIX\n | \n \n PickupSTIX 是免费、开源、非商业化的网络威胁情报源。目前 PickupSTIX 使用三个公共数据源，每天分发约 100 条新的情报数据。PickupSTIX 将各种威胁信息转换为 STIX 格式，因为 STIX 格式的数据可以与任何 TAXII 服务器互传。这些数据均可以免费使用，是开始入门威胁情报的好方法\n | \n
\n \n | \n REScure Threat Intel Feed\n | \n \n [RES]cure 是由 Fruxlabs Crack 团队运营的独立威胁情报项目，旨在增强对分布式系统底层架构的理解、威胁情报的性质以及如何有效地收集、存储、使用和分发威胁情报。 每六小时发布一次\n | \n
\n \n | \n RST Cloud Threat Intel Feed\n | \n \n 从多个开放来源和社区收集并经过交叉验证的 IOC 指标数据，使用 RST 提供的情报信息进行富化和排名\n | \n
\n \n | \n Rutgers Blacklisted IPs\n | \n \n 合并本地观测到的 IP 地址与 badip.com 和 blocklist.de 最新两小时的数据创建的暴力破解 SSH 的 IP 地址列表\n | \n
\n \n | \n SANS ICS Suspicious Domains\n | \n \n Suspicious Domains Threat 由 SANS ICS 提供对恶意域名的跟踪，提供三个列表分为 高, 中 or 低 三个层级，高级名单的错报低，低级名单的错报高。还有一个域名的 白名单
\n 另外，也有黑名单 IP blocklist 由 DShield 提供\n | \n
\n \n | \n SecurityScorecard IoCs\n | \n \n SecurityScorecard 发布的技术文章和分析报告\n | \n
\n \n | \n Stixify\n | \n \n 自动化威胁情报分析工具，从非结构化数据中提取可机读威胁情报\n | \n
\n \n | \n signature-base\n | \n \n 在其他工具中使用的签名数据库\n | \n
\n \n | \n The Spamhaus project\n | \n \n Spamhaus 项目包含包括垃圾邮件以及恶意软件活动在内的多种威胁情报\n | \n
\n \n | \n SophosLabs Intelix\n | \n \n SophosLabs Intelix 是为 Sophos 的产品和合作伙伴提供支持的威胁情报平台。可以基于文件哈希、URL 等进行查询，也可以提交样本进行分析。通过 REST API 可以快速地将威胁情报集成到已有系统中\n | \n
\n \n | \n Spur\n | \n \n Spur 能够检测 VPN、住宅代理和机器人。免费接口允许用户查询特定 IP 并获取其分类，以及 VPN 提供商、IP 所属地理位置以及一些更有用的上下文信息\n | \n
\n \n | \n SSL Blacklist\n | \n \n SSL Blacklist (SSLBL) 是由 abuse.ch 维护的项目，旨在提供一个与恶意软件、僵尸网络活动有关的不良 SSL 证书列表。SSLBL 提供恶意 SSL 证书的 SHA1 指纹，并且提供多种黑名单\n | \n
\n \n | \n Statvoo Top 1 Million Sites\n | \n \n Statvoo 排名的前一百万站点，可作为白名单\n | \n
\n \n | \n Strongarm, by Percipient Networks\n | \n \n Strongarm 是一个 DNS 黑洞，旨在提供阻止恶意软件 C&C 的 IOC 信息，其聚合了许多免费的订阅源，并与商业订阅集成，利用 Percipient 的 IOC 订阅，利用 DNS 解析与 API 来保护你的网络与企业。Strongarm 对个人使用是免费的\n | \n
\n \n | \n SIEM Rules\n | \n \n 检测工程数据库，用于查看、修改和部署 SIEM 规则以进行威胁狩猎\n | \n
\n \n | \n Talos\n | \n \n Cisco Talos Intelligence Group 是全球最大的商业威胁情报团队之一，由世界一流的研究人员、分析人员和工程师组成。该团队通过无与伦比的遥测数据，构建复杂的信息系统，为思科的客户、产品和服务提供准确、快速、可运营的威胁情报。该团队帮助思科的客户抵御已知与新出现的威胁，发现通用软件中的新漏洞，并在威胁进一步侵入整个互联网之前进行拦截。该团队发布了许多开源研究和分析工具，还维护着 Snort.org、ClamAV 和 SpamCop 的官方规则集合。此外，思科还对外提供了一个易用的界面查看网空对象的信誉信息\n | \n
\n \n | \n threatfeeds.io\n | \n \n threatfeeds.io 列出了免费和开源的威胁情报来源，并提供直接下载链接和实时摘要信息\n | \n
\n \n | \n threatfox.abuse.ch\n | \n \n ThreatFox 是 abuse.ch 提供的一个免费服务，为社区、反病毒软件厂商和威胁情报厂商共享恶意软件相关的 IOC\n | \n
\n \n | \n Technical Blogs and Reports, by ThreatConnect\n | \n \n 在九十多个开源博客中提取 IOCs (Indicators of Compromise)，博客内容使用 markdown 排版\n | \n
\n \n | \n Threat Jammer\n | \n \n Threat Jammer 是 REST API 服务，支持开发人员、安全工程师和其他 IT 专业人员检索来自各种来源的高质量威胁情报数据，并将其集成到应用程序中，以此检测和阻止恶意活动\n | \n
\n \n | \n ThreatMiner\n | \n \n ThreatMiner 为分析师从数据收集到执行分析提供了一个门户，ThreatMiner 关注的重点不仅仅是关于 IOC，还为分析人员提供有关 IOC 的上下文信息\n | \n
\n \n | \n WSTNPHX Malware Email Addresses\n | \n \n 由 VVestron Phoronix (WSTNPHX)收集的恶意软件使用的电子邮件地址\n | \n
\n \n | \n UnderAttack.today\n | \n \n UnderAttack 是一个免费的情报平台，它共享有关可疑事件和攻击的 IP 地址与其他信息。可以免费注册\n | \n
\n \n | \n URLhaus\n | \n \n URLhaus 是一个由 abuse.ch 发起的旨在共享用于恶意软件传播的 URL 的项目\n | \n
\n \n | \n VirusShare\n | \n \n VirusShare.com 是一个为安全研究员、事件响应人员、取证分析人员提供恶意样本的仓库，其中也含有很多恶意样本的代码，网站只能通过邀请得到访问授权\n | \n
\n \n | \n Yara-Rules\n | \n \n 收集不同 Yara 规则的开源库，经过分类并尽量保持时效性\n | \n
\n \n | \n 1st Dual Stack Threat Feed by MrLooquer\n | \n \n Mrlooquer 创建了第一个同时支持 IPv4 与 IPv6 的威胁源。由于 IPv6 协议已经开始成为恶意软件和欺诈通信的一部分，因此有必要检测和缓解两种协议（IPv4 与 IPv6）\n | \n
\n
\n\n## 格式\n\n用于分享的威胁情报标准化格式\n\n\n \n | \n AbuseHelper\n | \n \n AbuseHelper 是一个用来接收与重分配威胁情报订阅的开源框架\n | \n
\n \n | \n AbuseIO\n | \n \n 用于接收、处理、关联、通知用户有关滥用的信息\n | \n
\n \n | \n AIS\n | \n \n Department of Homeland Security’s (DHS) 设计的用于联邦政府和私营部门之间共享威胁指标的标准，威胁指标包括恶意 IP 地址或网络钓鱼邮件发送人等信息\n | \n
\n \n | \n Barncat\n | \n \n Fidelis Cybersecurity 注册后提供对 Barncat 免费的访问权限，该平台旨在为 CERT、研究人员、政府、ISP 以及大型组织提供，数据库保存着攻击者的各种信息\n | \n
\n \n | \n Bearded Avenger\n | \n \n CIF 的接替者，最快处理威胁情报的方式\n | \n
\n \n | \n Blueliv Threat Exchange Network\n | \n \n 允许社区的参与者共享威胁情报信息\n | \n
\n \n | \n Cortex\n | \n \n Cortex 允许对如 IP 地址、电子邮件地址、URL、域名、文件或哈希，在 bulk 模式下使用 Web 界面逐个分析。前端接口可以充当许多分析器的前端，从而消除了在分析过程中将其整合在一起的需求。分析人员还可以使用 Cortex REST API 进行自动分析\n | \n
\n \n | \n CRITS\n | \n \n CRITS 是一个为分析人员提供恶意软件和威胁情报协同研究的平台，可以作为中心情报数据库的一部分，但也可以独立成库\n | \n
\n \n | \n CIF\n | \n \n Collective Intelligence Framework (CIF) 允许你将已知的多源恶意威胁信息联结起来，可以用于 IR、检测与缓解，代码在 GitHub 上可用\n | \n
\n \n | \n CTIX\n | \n \n CTIX 是一个威胁情报平台（TIP），用于在可信网络内提取、丰富、分析和双向共享威胁情报数据\n | \n
\n \n | \n EclecticIQ Platform\n | \n \n EclecticIQ Platform 是基于 STIX/TAXII 的威胁情报平台（TIP），使分析人员能够更快、更好、更深入地调查，同时以机器速度分发威胁情报\n | \n
\n \n | \n IntelMQ\n | \n \n IntelMQ 是 CERTs 的一个为了收集和处理安全订阅数据的解决方案，其最初由 IHAP 发起，现在由社区驱动。目标是给事件响应者提供一个简单的方法来收集和处理威胁情报，从而改善 CERT 的事件处理过程\n | \n
\n \n | \n IntelOwl\n | \n \n Intel Owl 是一种 OSINT 解决方案，可从单个 API 大规模获取有关特定哈希、IP 或域名的威胁情报数据。Intel Owl 可以运行多个外部分析器从外部来源（如 VirusTotal 或 AbuseIPDB）检索数据或从内部分析器（如 Yara 或 Oletools）生成情报。它可以轻松集成到安全工具集 (pyintelowl) 中，以自动化通常由 SOC 分析师手动执行的常见工作。\n | \n
\n \n | \n Kaspersky Threat Intelligence Portal\n | \n \n 提供描述网络威胁、合法对象及其关系知识库的网站。订阅卡巴斯基实验室的威胁情报可提供四项补充服务：卡巴斯基威胁数据源、威胁情报报告、卡巴斯基威胁查找和卡巴斯基研究沙盒，所有这些服务均以人类可读和机器可读格式提供。\n | \n
\n \n | \n Malstrom\n | \n \n Malstrom 的目的是来跟踪与取证的神器，还包括 YARA 的规则库与一些调查的笔记。注：GitHub 仓库无人维护，没有新的 PR 被接受\n | \n
\n \n | \n ManaTI\n | \n \n ManaTI 期望通过使用机器学习技术帮助威胁分析人员自动寻找新的关系与推论\n | \n
\n \n | \n MANTIS\n | \n \n Model-based Analysis of Threat Intelligence Sources (MANTIS) 网络威胁情报管理框架支持各种标准语言（如 STIX 和 CybOX）来进行网络威胁情报的管理\n | \n
\n \n | \n Megatron\n | \n \n Megatron 是由 CERT-SE 实施的工具，用于收集和分析恶意 IP，带有数据统计、转换、分析以及事件响应的功能\n | \n
\n \n | \n MineMeld\n | \n \n Palo Alto Networks 创建的一个可扩展的威胁情报处理框架，它可以有效管理 IOC 列表，并将其转换/汇总到第三方基础架构中使用\n | \n
\n \n | \n MISP\n | \n \n Malware Information Sharing Platform (MISP) 是一个收集、存储、分发和分享网络安全指标和恶意软件分析信息的开源软件解决方案\n | \n
\n \n | \n n6\n | \n \n n6 (Network Security Incident eXchange) 是一个大规模收集、管理、分发安全信息的系统，通过简单的 REST API 和 Web 界面即可实现分发，授权用户可以使用它来接收各种类型的数据，特别是有关其网络中威胁的信息，其由 CERT Polska 开发\n | \n
\n \n | \n OpenCTI\n | \n \n OpenCTI 是一个开放式网络威胁情报平台，允许组织管理其网络威胁情报知识。 其目标是构建、存储、组织和可视化有关网络威胁的技术和非技术信息。数据围绕 STIX2 标准的知识模式构建。OpenCTI 可以与其他工具和平台集成，包括 MISP、TheHive 和 MITRE ATT&CK\n | \n
\n \n | \n OpenIOC\n | \n \n OpenIOC 是一个开放的共享威胁情报的框架，它的目的是用计读的格式互通内部与外部的威胁情报信息\n | \n
\n \n | \n OpenTAXII\n | \n \n OpenTAXII 是 TAXII 的一个 Python 实现，提供了一系列丰富的功能与友好的 Python API\n | \n
\n \n | \n OSTrICa\n | \n \n 一个开源的插件化框架来对威胁情报的收集与可视化\n | \n
\n \n | \n OTX - Open Threat Exchange\n | \n \n AlienVault Open Threat Exchange (OTX) 为威胁研究人员和安全专业人士提供全球开放访问，其提供社区生成的威胁数据来实现协作研究，并自动更新汇聚多来源的威胁数据来完善安全基础设施建设\n | \n
\n \n | \n Open Threat Partner eXchange\n | \n \n Open Threat Partner eXchange (OpenTPX) 由开源格式和用于机器的威胁情报和网络安全工具组成，它是一种基于 JSON 的格式，允许在互联的系统间共享情报\n | \n
\n \n | \n Open Threat Partner eXchange\n | \n \n Open Threat Partner eXchange（OpenTPX）由开源格式和工具组成，用于交换机器可读的威胁情报和网络安全运营数据。它是一种基于 JSON 的格式，允许在连接的系统之间共享数据\n | \n
\n \n | \n PassiveTotal\n | \n \n RiskIQ 提供的 PassiveTotal 平台是一个威胁分析平台，可以为威胁分析人员提供尽可能多的数据，来阻止曾经发生过的攻击，提供了不同类型的解决方案和与其他系统的整合\n | \n
\n \n | \n Pulsedive\n | \n \n Pulsedive 是一个免费的社区威胁情报平台，聚合开源资源，丰富 IOC，并通过风险评分算法过滤 IOC 以提高数据质量。它允许用户提交、搜索、关联与更新 IOC，列出 IOC 的“风险因素”，并提供威胁和威胁活动的高级视图\n | \n
\n \n | \n Recorded Future\n | \n \n Recorded Future 是一个优秀的 SaaS 产品，可以将不同类型的威胁情报整合到单一的解决方案中，其使用自然语言处理（NLP）和机器学习来实时提供威胁情报，这些都让 Recorded Future 成为 IT 安全团队的热门选择\n | \n
\n \n | \n Scumblr\n | \n \n Scumblr 是一个可以执行数据源定期同步的 Web 应用程序，并对可识别的结果执行分析（如静态分析、动态检测和元数据收集）。Scumblr 可以帮助你通过智能自动化框架简化安全分析过程，以帮助你更快地识别、跟踪和解决安全问题\n | \n
\n \n | \n STAXX (Anomali)\n | \n \n Anomali STAXX™ 提供了一种免费、简便地方式来处理任何 STIX/TAXII 类的订阅信息。只需要下载 STAXX 客户端，配置好数据源就可以由它完成后续的工作\n | \n
\n \n | \n stoQ\n | \n \n stoQ 是一个允许网络分析师来组织、自动化那些数据驱动的任务，，它具有许多可用于其他系统的插件，一种用例是从文档中提取 IOC，例如 博客, 也可以用于解帧和解码以及 YARA 的自动扫描\n | \n
\n \n | \n TARDIS\n | \n \n Threat Analysis, Reconnaissance, and Data Intelligence System（TARDIS）是使用攻击特征进行检索的开源框架\n | \n
\n \n | \n ThreatConnect\n | \n \n ThreatConnect 是一个分析、编排威胁情报的平台。它旨在帮助收集数据、产生情报、与他人分享数据并采取行动\n | \n
\n \n | \n ThreatCrowd\n | \n \n ThreatCrowd 是一个发现和研究有关网络威胁的系统\n | \n
\n \n | \n ThreatPipes\n | \n \n
\n ThreatPipes 可以自动查询 100 余个数据源，以收集与 IP 地址、域名、电子邮件地址、名称等有关的情报\n
\n 只需指定要调查的目标，选择要启用的模块，然后 ThreatPipes 将自动收集数据\n | \n
\n \n | \n ThreatExchange\n | \n \n Facebook 创建了 ThreatExchange 可以方便的使用结构化、易用的 API 来共享威胁数据，该 API 提供隐私控制，以便与所需的组织进行共享，该项目仍然处于测试阶段，参考代码可以在 GitHub 中找到\n | \n
\n \n | \n TypeDB CTI\n | \n \n TypeDB Data - CTI 是一个开源威胁情报平台，存储和管理威胁情报。该平台使分析人员能够将不同来源的威胁信息整合到一处，并发现有关网络威胁的新见解。该平台基于 STIX2 搭建架构，并且支持 MITRE ATT&CK。更多信息可参见博客文章\n | \n
\n \n | \n VirusBay\n | \n \n VirusBay 是一个基于 Web 的协作平台，可将 SOC 与恶意软件研究人员联系起来\n | \n
\n \n | \n threatnote.io\n | \n \n 经过改进的 Threatnote.io-CTI 分析团队使用的工具，可以在多平台上管理情报、报告和 CTI 流程\n | \n
\n \n | \n XFE - X-Force Exchange\n | \n \n IBM XFE 开发的 X-Force Exhange (XFE) 是一款免费的 SaaS 产品，可用于搜索威胁情报信息，收集你的数据并与 XFE 社区的其他成员分享你的看法\n | \n
\n \n | \n Yeti\n | \n \n 开放、分布式、机器与分析友好的威胁情报存储库，由应急响应人员制作\n | \n
\n
\n\n\n\n## 工具\n\n用户创建、解析、编辑威胁情报的各种工具，大多数基于 IOC\n\n\n \n | \n ActorTrackr\n | \n \n ActorTrackr 是一个用来存储/搜索/链接事件相关数据的开源 Web 应用程序。主要来源是用户以及各种公共资料库，也有一些来自 GitHub\n | \n
\n \n | \n AIEngine\n | \n \n AIEngine 是下一代交互式支持 Python/Ruby/Java/Lua 编程的包检测引擎，无需任何人工干预，具有 NIDS 的功能、DNS 域名分类、网络流量收集、网络取证等许多功能\n | \n
\n \n | \n Analyze (Intezer)\n | \n \n Analytics 是一个一体化恶意软件分析平台，能够对所有类型的文件执行静态分析、动态分析和同源代码分析。用户可以利用该平台跟踪恶意软件家族、提取 IOC/MITRE TTP 并下载 YARA 签名。Intezer 也提供了社区版可以免费使用\n | \n
\n \n | \n Automater\n | \n \n Automater 是一个集合 URL/Domain、IP Address 和 Md5 的 OSINT 工具，旨在让入侵分析变得更轻松\n | \n
\n \n | \n BlueBox\n | \n \n BlueBox 是一个 OSINT 解决方案，用于获取有关特定哈希、IP、域名或 URL 的威胁情报数据并对其进行分析。\n | \n
\n \n | \n BotScout\n | \n \n BotScout 有助于防止论坛注册自动化 Web 脚本、污染数据库、传播垃圾邮件、滥用网站上的表单\n | \n
\n \n | \n bro-intel-generator\n | \n \n 从 PDF 或 HTML 报告中提取信息生成 Bro intel 文件的脚本\n | \n
\n \n | \n cabby\n | \n \n 一个用来和 TAXII 服务器进行交互的简单 Python 库\n | \n
\n \n | \n cacador\n | \n \n Cacador 是一个使用 Go 编写的工具，用来从一段文本中提取常见的威胁情报指标\n | \n
\n \n | \n Combine\n | \n \n Combine 聚合了多个公开源的威胁情报\n | \n
\n \n | \n CrowdFMS\n | \n \n CrowdFMS 是一个利用私有 API 来自动收集与处理来自 VirusTotal 的样本的框架，该框架会自动下载最近的样本，从而触发 YARA 提醒订阅的警报\n | \n
\n \n | \n CyberGordon\n | \n \n CyberGordon 是一个威胁情报搜索引擎，一共集成了 30 多个情报来源\n | \n
\n \n | \n CyBot\n | \n \n CyBot 是一个威胁情报聊天机器人，可以执行自定义模块提供的多类型的查找\n | \n
\n\t\n | \n Cuckoo Sandbox\n | \n \n Cuckoo 沙盒是自动化动态恶意软件分析系统。它是最知名的开源恶意软件分析沙盒，由研究人员、CERT/SOC 团队和全球的威胁情报团队部署。对于许多组织来说 Cuckoo 沙盒可以发现第一个潜在的恶意软件样本\n | \n
\n \n | \n Fenrir\n | \n \n 简单的 Bash IOC 扫描器\n | \n
\n \n | \n FireHOL IP Aggregator\n | \n \n 保留 FireHOL 黑名单 IP 地址数据集，包括历史更改，针对请求开发的基于 HTTP 的 API 服务\n | \n
\n \n | \n Forager\n | \n \n 多线程威胁情报收集脚本\n | \n
\n \n | \n Gigasheet\n | \n \n Gigasheet 是一个 SaaS 产品，用于分析大量不同的网络安全数据集，支持导入海量日志文件、netflow、pcaps、大型 CSV 等\n | \n
\n \n | \n GoatRider\n | \n \n GoatRider 会动态拉取 Artillery Threat Intelligence 订阅数据、TOR、AlienVaults OTX 以及 Alexa top 1 million websites 与给定的主机名或 IP 进行比较\n | \n
\n \n | \n Google APT Search Engine\n | \n \n APT 组织与恶意软件搜索引擎，用于此 Google 自定义搜索的来源列表在 GitHub 中\n | \n
\n \n | \n GOSINT\n | \n \n The GOSINT 框架是一个免费项目，用于收集、处理和导出高质量的 IOC 指标\n | \n
\n \n | \n hashdd\n | \n \n 在 crytographic 上使用哈希值查找相关信息的工具\n | \n
\n \n | \n Harbinger Threat Intelligence\n | \n \n 从单一接口查询多个在线威胁情报聚合服务的 Python 脚本\n | \n
\n \n | \n Hippocampe\n | \n \n Hippocampe 是一个从互联网中聚合威胁订阅的 Elasticsearch 集群。它拥有一个 REST API，基于一个可以 fetch 对应订阅的 URL 的 Python 脚本，还可以进行解析与索引\n | \n
\n \n | \n Hiryu\n | \n \n 一个用来组织 APT 组织信息的工具，并提供 IOC 之间关系的可视化展示\n | \n
\n \n | \n IOC Editor\n | \n \n 一个免费的 Indicators of Compromise (IOCs) 编辑器\n | \n
\n \n | \n IOC Finder\n | \n \n 用于查找文本中 IOC 指标的 Python 库。使用语法而不是正则表达式来提高可理解性。截至 2019 年 2 月，可以解析 18 种类型的 IOC 指标\n | \n
\n \n | \n IOC Fanger (and Defanger)\n | \n \n 用于在 fanging（`hXXp://example[.]com` => `http://example.com`） 与 defanging（`http://example.com` => `hXXp://example[.]com`） 转换的 Python 库\n | \n
\n \n | \n ioc_parser\n | \n \n 从 PDF 格式的安全报告中提取 IOC 的工具\n | \n
\n \n | \n ioc_writer\n | \n \n 一个可以创建/编辑基本 OpenIOC 对象的 Python 库\n | \n
\n \n | \n iocextract\n | \n \n 从文本中提取 URL、IP 地址、MD5/SHA 哈希、电子邮件地址与 YARA 规则。在输出中包含一些编码或处理后的 IOC 指标，可选择将其解码/反处理\n | \n
\n \n | \n IOCextractor\n | \n \n IOC (Indicator of Compromise) Extractor 是一个帮助从文本文件中提取 IOC 的程序，旨在加速从非结构化数据/半结构化数据中提取结构化数据的过程\n | \n
\n \n | \n ibmxforceex.checker.py\n | \n \n IBM X-Force Exchange 的 Python 客户端\n | \n
\n \n | \n jager\n | \n \n Jager 是一个从各种数据源（现在已支持 PDF，很快支持纯文本，最终会支持网页）提取有用的 IOC 并将其变成易于操作的 JSON 格式的工具\n | \n
\n \n | \n Kaspersky CyberTrace\n | \n \n 威胁情报融合和分析工具，将威胁数据与 SIEM 解决方案集成在一起。用户可以利用威胁情报在现有安全运营工作流程中进行安全监控和事件报告\n | \n
\n \n | \n KLara\n | \n \n KLara 是一个使用 Python 编写的分布式系统，可以扫描一个或多个 Yara 规则、通过邮件获取通知、通过 Web 界面查看扫描结果\n | \n
\n \n | \n libtaxii\n | \n \n 可以调用 TAXII 服务处理 TAXII 信息的 Python 库\n | \n
\n \n | \n Loki\n | \n \n 简单的 IOC 与事件响应扫描器\n | \n
\n \n | \n LookUp\n | \n \n LookUp 是一个有关 IP 地址的各种威胁信息的聚合页面，可以轻松的被集成到工具的上下文菜单中，如 SIEM 或其他调查工具\n | \n
\n \n | \n Machinae\n | \n \n Machinae 是一个用于从公开站点/订阅源收集各种与安全相关数据的工具，包括 IP 地址、域名、URL、电子邮件地址、文件哈希值与 SSL 指纹\n | \n
\n \n | \n MalPipe\n | \n \n Amodular 是一个针对恶意软件与 IOC 指标收集与处理的框架。旨在从多个不同的源中提取恶意软件、域名、URL 和 IP 地址，汇总收集到的数据并导出结果\n | \n
\n \n | \n MISP Workbench\n | \n \n 将 MISP 的 MySQL 数据库导出，使之可以在外部应用\n | \n
\n \n | \n MISP-Taxii-Server\n | \n \n 一组用于使用 EclecticIQ 的 OpenTAXII 实例的配置文件，当数据送达 TAXII 服务器的收件箱时带有回调\n | \n
\n \n | \n MSTIC Jupyter and Python Security Tools\n | \n \n msticpy 是用于调查和狩猎的 Jupyter Notebook\n | \n
\n \n | \n nyx\n | \n \n 该项目的目标是促进威胁情报分发到防御系统中，并增强从开源和商业工具中获得的价值\n | \n
\n \n | \n OneMillion\n | \n \n 用于确定域名是否在 Alexa 或 Cisco 的 TOP 100 万域名列表中的 Python 库\n | \n
\n \n | \n openioc-to-stix\n | \n \n 转换 STIX XML 为 OpenIOC XML\n | \n
\n \n | \n Omnibus\n | \n \n Omnibus 是一个交互式命令行程序，用于收集、管理 IOC 指标，使用公共 OSINT 数据进行补充，并提供存储与访问这些指标的简单方法\n | \n
\n \n | \n OSTIP\n | \n \n 自制的威胁数据平台\n | \n
\n \n | \n poortego\n | \n \n 用于处理/链接开源威胁情报的项目。最初用 ruby 开发，新版本用 python 重写了\n | \n
\n \n | \n PyIOCe\n | \n \n PyIOCe 是一个使用 Python 编写的 IOC 编辑器\n | \n
\n \n | \n QRadio\n | \n \n QRadio 是一个旨在巩固网络威胁情报源的工具/框架，该项目试图建立一个强大的框架来审查提取得到的威胁情报数据\n | \n
\n \n | \n rastrea2r\n | \n \n 收集与整理 Indicators of Compromise (IOC)\n | \n
\n \n | \n Redline\n | \n \n 主机调查工具，分析其可用于 IOC 分析的数据\n | \n
\n \n | \n RITA\n | \n \n Real Intelligence Threat Analytics (RITA) 旨在帮助不同规模的企业在网络中搜索 IOC\n | \n
\n \n | \n Softrace\n | \n \n 轻量级国家软件参考库 RDS 存储\n | \n
\n \n | \n sqhunter\n | \n \n 基于 osquery、Salt Open 与 Cymon API 的狩猎工具，可以通过网络查询威胁情报\n | \n
\n \n | \n SRA TAXII2 Server\n | \n \n 带有 MongoDB 后端的 Node JS 实现的完整 TAXII 2.0 服务器\n | \n
\n \n | \n Stixview\n | \n \n Stixview 是一个用于控制交互式 STIX2 图数据的 JavaScript 库\n | \n
\n \n | \n stix-viz\n | \n \n STIX 可视化工具\n | \n
\n \n | \n TAXII Test Server\n | \n \n 允许你通过连接给定的服务并执行 TAXII 给定的各种功能来测试你的 TAXII 环境\n | \n
\n \n | \n threataggregator\n | \n \n ThreatAggregrator 聚合了许多在线的威胁情报源，支持输出到各种格式，包括 CEF、Snort 和 iptables 的规则\n | \n
\n \n | \n threatcrowd_api\n | \n \n 使用 ThreatCrowd API 的 Python 库\n | \n
\n \n | \n threatcmd\n | \n \n ThreatCrowd 的命令行接口\n | \n
\n \n | \n Threatelligence\n | \n \n Threatelligence 是一个简单的威胁情报订阅收集器，使用 Elasticsearch、Kibana 和 Python 来自动收集自定义或开源的情报，自动跟踪数据更新，但是项目似乎以及放弃更新了\n | \n
\n \n | \n ThreatIngestor\n | \n \n 用于消费威胁情报的灵活的、配置驱动的、可扩展的框架。 ThreatIngestor 可以处理 Twitter、RSS 和其他来源，从中提取有意义的信息，如 C&C 的 IP、域名或 YARA 签名，并将该信息发送到其他系统进行分析\n | \n
\n \n | \n ThreatPinch Lookup\n | \n \n 一个用于在每个页面查找 IPv4、MD5、SHA2 以及 CVEs 的 Chrome 扩展程序\n | \n
\n \n | \n ThreatTracker\n | \n \n 用于监控并生成一组由 Google 自定义搜索引擎得出的 IOC 数据集\n | \n
\n \n | \n threat_intel\n | \n \n 多个威胁情报的 API 聚合在一个包中，其中包括 OpenDNS Investigate、VirusTotal 和 ShadowServer\n | \n
\n \n | \n Threat-Intelligence-Hunter\n | \n \n TIH 是一个可以帮助你在多个可公开提取的安全订阅源与知名 API 中提取 IOC 的智能工具，创建这个工具的初衷就是为了方便搜索、存储 IOC，以方便你创建自己的本地数据库\n | \n
\n \n | \n tiq-test\n | \n \n Threat Intelligence Quotient (TIQ) 测试工具提供对威胁情报的可视化与统计分析\n | \n
\n \n | \n YETI\n | \n \n YETI 是一个 TAXII 的概念验证，带有收件箱、轮询和 TAXII 的特定服务支持\n | \n
\n
\n\n\n\n## 研究、标准、书籍\n\n威胁情报的各种材料，包括研究与白皮书\n\n