APTtrail source & docs

APT indicators that tell you whose they are

Most free feeds hand you a list of bad domains. This one hands you the actor, its ATT&CK id, the date it appeared and the write-up it came from — for every indicator.

Indicators
171,566
Actors
312 97 carry an ATT&CK id
Sourced
100% name their report
Updated
…
Look up an indicator an alert fired Browse 312 actors by name or alias What moved recently last 30 days How actors relate 201 links

One request, from an alert to an answer

# what do you know about this domain?
IOC=doosan-job.com
shard=$(printf %s "$IOC" | sha256sum | cut -c1-2)
curl -s https://trilwu.github.io/apttrail/by-indicator/$shard.json | jq --arg v "$IOC" '.[$v]'
{
  "type": "domain",
  "groups": ["CLEAVER"],
  "attack_ids": ["G0003"],
  "first_seen": "2015-03-18",
  "references": ["http://www.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"]
}

The actor, its ATT&CK id, the date it appeared upstream, and the write-up it came from — from one 178 KB fetch, with no key and no account. Try it in the browser.

What you get that a blocklist does not

Attribution
97 ATT&CK sets resolved from 124 of 339 upstream groups, and the id travels into every export format — so a hit in Suricata or MISP still says whose.
Provenance
171,565 of 171,566 indicators name the report that published them. Not a reference list at the bottom of a page — the specific write-up behind that specific value.
History
2015 → 2026 157,786 carry an exact first-seen date, recovered from history upstream had discarded. Filter on age instead of blocking a domain last used in 2016.
No friction
Static files on stable URLs. No account, no key, no rate limit, rebuilt hourly. Look-ups run in your browser, so nothing you paste is sent anywhere.

Into your tooling

  • MISP
    add the URL as a feed; one event per actor
  • STIX 2.1
    intrusion-set objects, merges with ATT&CK
  • Suricata
    ~4,100 dataset-backed rules, validated in CI
  • Sigma
    one rule per group, attack.gXXXX tagged
  • Flat lists
    one value per line, for a blocklist
  • JSON / CSV
    per actor, with dates and sources

The ATT&CK id survives the trip: metadata:apt_group SOFACY, mitre_group_id G0007; in Suricata, a misp-galaxy:mitre-intrusion-set tag in MISP, an external_references entry in STIX. Setup for each tool.

Start here

# every domain APT28 has been seen using
curl -sL https://trilwu.github.io/apttrail/by-group/G0007-domain.txt

# one actor, full detail: dates, sources, ATT&CK
curl -sL https://trilwu.github.io/apttrail/by-group/G0007.json

# what exists, with counts
curl -sL https://trilwu.github.io/apttrail/index.json

Also: Atom feed of new indicators, graph.json, and per-group ATT&CK Navigator layers.