Threat Intel

Curated, open-source threat intelligence for defensive use — starting with IOC watchlists ready to drop into Microsoft Sentinel (unified SecOps portal) or any threat-intelligence platform.

Everything here is built from public reporting. No private intelligence, nothing you can't verify at source.

Layout

threat-intel/
└── watchlists/
    ├── _all-iocs.csv          # master — union of every per-threat list below
    ├── build-master.sh        # regenerates _all-iocs.csv from the per-threat files
    └── <threat>.csv           # one file per campaign / malware family

• Per-threat files (e.g. spirals-ransomware.csv) — the working unit. One campaign or malware family per file.
• _all-iocs.csv — the aggregated master, a straight union of every per-threat file. Load this when you want one watchlist covering everything; load an individual file when you want to scope to a single threat.

Schema

All watchlists share one column layout, so the master is a clean concatenation:

Column	Meaning
Indicator	The IOC value (hash, IP, URL, file name, path). Use as the Sentinel SearchKey.
IndicatorType	SHA256 | IPv4 | URL | FileName | FilePath
Threat	Campaign / family the indicator belongs to (e.g. Spirals)
Context	Short description of the indicator's role
MitreTTP	Primary MITRE ATT&CK technique ID
Source	Reporting source
FirstSeen	Date first reported (YYYY-MM-DD)

Using a watchlist in Microsoft Sentinel (unified portal)

1. In security.microsoft.com, go to Microsoft Sentinel → Configuration → Watchlists → + Add new.
2. Set the Alias (e.g. Spirals, or AllIOCs for the master), upload the CSV, and set SearchKey to Indicator.
3. Reference it from Advanced Hunting via _GetWatchlist('<alias>').

No Sentinel? These are plain CSVs — import into any TIP, a Defender custom indicators list, or a firewall block list.

Adding a threat

1. Create watchlists/<threat>.csv using the schema above.
2. Run watchlists/build-master.sh to regenerate _all-iocs.csv.
3. Commit both.

Caveats

Static indicators (hashes, IPs, URLs) age fast and are trivial for an attacker to rotate. Treat them as cheap tripwires, and pair them with behavioural detections — see the companion kql-library repo.

License

MIT. Indicators are reproduced from public reporting for defensive use only.