IA Threat Intelligence Feed Evaluation Based On URL IO Cs

Query

let BotvrijRAW = externaldata(Url: string)[@'https://www.botvrij.eu/data/ioclist.domain']| extend Url = substring(Url, 0, indexof(Url, '#'))| where isnotempty(Url) or Url != ''| project TIFeed= 'BotvrijRAW',IOC= Url,Reference = 'https://www.botvrij.eu/data/ioclist.domain';
let montysecurity =externaldata(URLS:string)[@'https://raw.githubusercontent.com/montysecurity/C2-Tracker/refs/heads/main/data/all.txt'] with (format='csv') | project TIFeed= 'montysecurity',IOC= URLS,Reference = 'C2IntelFeeds';
 let PhishuntURLs = externaldata (Url: string) ['https://phishunt.io/feed.txt']| where Url !in ('https://www.google.com/chrome/','https://www.microsoft.com/en-us/microsoft-teams/log-in')| project TIFeed= 'PhishuntURLs',IOC= Url,Reference = 'https://hole.cert.pl/domains/v2/domains.txt';
 let C2IntelFeeds =externaldata(URLS:string)[@'https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/refs/heads/master/feeds/domainC2swithURLwithIP-30day-filter-abused.csv']with (format='csv') | where URLS !startswith '#' | project TIFeed= 'C2IntelFeeds',IOC= URLS,Reference = 'C2IntelFeeds';
 let Openphish =externaldata(URLS:string)[@'https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt']with (format='csv') | project TIFeed= 'OpenPhish',IOC= URLS,Reference = 'https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt';
 let URL_TweetFeedMonth =externaldata(DateUTC: datetime,SourceUser: string,Type: string,Value: string,Tags: string,Tweet: string)[@'https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv']with (format='csv') | where Type has 'url' | project TIFeed= 'URL_TweetFeedMonth',IOC= Value,Reference='https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv';
 //unify TIFeeds IOC List
 let URL_IOCs = union Openphish,C2IntelFeeds,URL_TweetFeedMonth,BotvrijRAW,PhishuntURLs;
 //ℹ️ Remove the comments of the 2 following lines to get a summary of the IOCs present on distinct TI Feeds
 //URL_IOCs | summarize dcount(TIFeed),make_set(TIFeed) by IOC | order by dcount_TIFeed
//
   EmailUrlInfo   | where Timestamp > ago(30d) | join kind=inner (URL_IOCs) on $left.Url == $right.IOC
    | join kind=inner (EmailEvents) on NetworkMessageId | extend IPSender = iff(isnotempty( SenderIPv4),SenderIPv4,SenderIPv6) | extend Time_ = format_datetime( Timestamp, 'yyyy-MM-dd') 
    | summarize by Time_,TIFeed,IOC,DeliveryLocation, Url,Subject,IPSender, SenderMailFromDomain,Reference

About this query

MITRE ATT&CK Technique(s)

Technique ID	Title
T1566.002	Phishing: Spearphishing Link

Author: Sergio Albea (17/01/2026)

[IA] - Threat Intelligence Feed Evaluation based on URL IOCs

Technique ID	Title
T1566.002	Phishing: Spearphishing Link

Author	Sergio Albea (12/01/2026)

TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity. 🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain. In addition, if you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.

Explanation

This KQL (Kusto Query Language) script is designed to evaluate the usefulness of threat intelligence feeds by focusing on URL-based indicators of compromise (IOCs). Here's a simplified breakdown of what the query does:

Data Sources: The script pulls data from several external threat intelligence feeds, each providing lists of potentially malicious URLs. These feeds include:
- BotvrijRAW
- Montysecurity
- PhishuntURLs
- C2IntelFeeds
- Openphish
- URL_TweetFeedMonth
Data Processing:
- Each feed's data is processed to extract URLs and relevant metadata, such as the feed name and reference links.
- The script ensures that only valid URLs are considered by filtering out empty or commented lines.
Unification:
- All the URLs from the different feeds are combined into a single list called URL_IOCs.
IOC Evaluation:
- The script checks if any of the URLs from the unified list have been involved in email events within the last 30 days.
- It joins this data with email event logs to find matches, focusing on URLs that have been delivered via email.
Output:
- For each matched URL, the script provides details such as the time of the event, the threat intelligence feed it came from, the delivery location, the email subject, the sender's IP address, and the sender's domain.
Purpose:
- This process helps evaluate the effectiveness of threat intelligence feeds by identifying which feeds provide unique, actionable, and confirmed malicious URLs.
- It simplifies the detection process by using a single detection rule per IOC type, making it easier to maintain and manage.

Overall, this query is a tool for cybersecurity professionals to assess and optimize their threat intelligence sources, ensuring they rely on feeds that provide valuable and actionable information.

Details

Sergio Albea

Released: July 21, 2026

Tables

EmailUrlInfoEmailEvents

Keywords

ThreatIntelligenceFeedUrlDomainsFileHashesEmailEventsNetworkMessageIdSenderIPv4IPv6TimestampDeliveryLocationSubjectMailFromDomain

Operators

letexternaldataextendsubstringindexofwhereisnotemptyorprojectwithformat!in!startswithunionjoinkindon$left==$rightiffsummarizebyformat_datetimeorder bydcountmake_set

MITRE Techniques

T1566.002

Actions

GitHub

KQL Search