IA Threat Intelligence Feed Evaluation Based On File Hashes IO Cs
Query
//Sergio Albea 12-01-2026 TIFCE https://zenodo.org/records/18208974
//TI Feeds Repositories
let MispHashes = externaldata(HashValue: string)['https://bazaar.abuse.ch/export/txt/sha256/recent/']with (format = 'csv',ignoreFirstRecord = true) | where HashValue !startswith '#' | project TIFeed= 'bazaar.abuse.ch',IOC= HashValue,Reference = 'https://bazaar.abuse.ch/export/txt/sha256/recent/';
let botvrij = externaldata(HashValue: string)['https://www.botvrij.eu/data/ioclist.sha256']with (format = 'csv',ignoreFirstRecord = true) | where HashValue !startswith '#' | extend Parts = split(HashValue, " ") | extend SHA256 = tostring(Parts[0])| project TIFeed= 'botvrij',IOC= SHA256,Reference = 'https://www.botvrij.eu/data/ioclist.sha256';
let FH_TweetFeedYear =externaldata(DateUTC: datetime,SourceUser: string,Type: string,Value: string,Tags: string,Tweet: string)['https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv']with (format='csv') | where Type has 'sha256' | project TIFeed= 'FH_TweetFeedYear',IOC= Value, Reference ='https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv';
//unify TIFeeds IOC List
let FH_IOCs = union MispHashes,botvrij,FH_TweetFeedYear;
//âšī¸ Remove the comments of the 2 following lines to get a summary of the IOCs present on distinct TI Feeds
// FH_IOCs | summarize dcount(TIFeed),make_set(TIFeed) by IOC | order by dcount_TIFeed
//
EmailAttachmentInfo
| join kind=inner (FH_IOCs) on $left.SHA256 == $right.IOC
| join kind=inner (EmailEvents) on NetworkMessageIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1566.001 | Phishing: Spearphishing Attachment |
Author: Sergio Albea (17/01/2026)
[IA] - Threat Intelligence Feed Evaluation based on FileHashes IOCs
| Technique ID | Title |
|---|---|
| T1566.001 | Spearphishing Attachment |
| Author | Sergio Albea (12/01/2026) |
|---|
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things â uniqueness, real matches, confirmed maliciousness, and activity. đ¨ TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain. In addition, if you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
Explanation
This query is designed to evaluate the effectiveness of threat intelligence feeds by checking for matches between known malicious file hashes and email attachments. Here's a simplified breakdown:
-
Purpose: The query aims to assess the usefulness of threat intelligence feeds by identifying unique, real, and confirmed malicious file hashes (IOCs - Indicators of Compromise) found in email attachments.
-
Data Sources:
- It pulls file hashes from three external threat intelligence feeds:
bazaar.abuse.chbotvrijFH_TweetFeedYear
- These feeds provide lists of potentially malicious SHA256 file hashes.
- It pulls file hashes from three external threat intelligence feeds:
-
Process:
- The query combines file hashes from the three feeds into a unified list (
FH_IOCs). - It then matches these hashes against email attachment data (
EmailAttachmentInfo) to find any overlaps. - It further joins this data with email event information (
EmailEvents) to provide context on the emails containing these attachments.
- The query combines file hashes from the three feeds into a unified list (
-
Outcome: By identifying which file hashes from the threat intelligence feeds are present in email attachments, the query helps determine the relevance and effectiveness of these feeds in detecting potential threats.
-
Additional Features:
- The query includes commented-out lines that, if activated, would provide a summary of how many distinct feeds contain each IOC, helping to evaluate the uniqueness and coverage of the feeds.
Overall, this query is a tool for evaluating and optimizing the use of threat intelligence feeds in detecting spearphishing attempts through malicious email attachments.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques