Free Threat Intel/IOC Feeds

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. The CSV ThreatIntelFeeds.cvs is stored in a structured manner based on the Vendor, Description, Category and the URL. The vendors offering ThreatIntelFeeds are described below. The following feed categories are available:

SSL
IP
DNS
URL
MD5
SHA1
SHA256
CVEID

Combine Threat Intel in your EDR and SIEM

The feeds available in this repository can be used to perform threat hunting in your EDR or SIEM solution to hunt for malicious activity. For Defender For Endpoint and Sentinel some KQL hunting rules have already been written to be implemented in your EDR or SIEM. See: KQL Hunting Queries

Contributions

Contributions are much appreciated to make this list with free Threat Intel/IOC feeds as big and as up to date as possible. You can contribute by creating a pull request. This PR must contain the following content:

Add the link of the feed in the README.md file. If there is not a section yet in which the source fits, create a new section.
Add the details to the ThreatIntelFeeds.csv file, the format which is used is shown below. The Category refers to the feed categories shown above.
```
Vendor;Description;Category;Url
```
Lastly, the source must be free and usable without any account or API token needed.