This weblog is continuation of the earlier weblog on utilizing Cisco Safe Community Analytics. On this half, we cowl leveraging public Cisco Talos blogs and third-party menace intelligence knowledge with Cisco Safe Community Analytics. Remember to learn the primary half as this half makes references again to Host Group and Customized Safety Occasion directions lined within the unique weblog.
Cisco Talos Blogs
The gifted researchers at Cisco Talos recurrently publish blogs on threats and vulnerabilities. These blogs break down the ways, methods and procedures (TTPs) utilized by menace actors. Talos’ analysis publications typically embody pattern supply code, phishing emails, reverse engineering of malicious binaries, instruments, scripts, command and management methodology, attacker infrastructure, file hashes, domains and IP addresses utilized in malicious operations. The symptoms of compromise (IOCs) are printed on GitHub as JSON and plain textual content information. We are able to use these blogs and GitHub information to construct Customized Safety Occasions in Cisco Safe Community Analytics.
Let’s have a look at a weblog: MoonPeak malware from North Korean actors unveils new particulars on attacker infrastructure. This weblog focuses on a state-sponsored group from North Korea. The group leverages an open-source distant entry trojan (RAT) from a household being referred to as MoonPeak.
Scroll by means of the article and take note of the extent of element offered. Close to the very backside of the weblog discover the part titled IOCs.
Click on on the hyperlink to the GitHub repository. You’ll be taken to the Cisco Talos GitHub repository the place you will see the IOCs can be found as JSON and plain textual content information, and are sorted by the month the weblog was printed in. Be happy to discover different information, months, and years to get conversant in the symptoms recurrently offered.
Click on on the file “moonpeak-infrastructure-north-korea.txt” or observe the direct hyperlink. Scroll right down to line 35 of the file the place the Community IOCs start. This checklist incorporates twelve IP addresses we’re fascinated with. Seen that the IP addresses and domains have been defanged with sq. brackets across the dots so you can’t by accident click on on them.
You may both manually delete the sq. brackets or use the discover and change performance in your favourite textual content editor to do the job. I favor to make use of Notepad++ when coping with textual content information. I set the “Discover and Change” to search for the sq. brackets across the dot and change all cases with a dot.
Delete the domains from the checklist and replica and paste these IP addresses right into a New Host Group utilizing the methods described within the first a part of this weblog.
You might also think about using a instrument to extract IP addresses from textual content. I actually like iplocation IP Extractor. You may paste in a block of textual content with IPv4 and IPv6 IP addresses and it’ll extract them to allow them to be simply reviewed and pasted into a bunch group. The IPs you paste into this instrument can’t be defanged. It requires full and proper IP addresses to work.
All the time think about the sensitivity of the data you present to public instruments earlier than utilizing them. It’s best to think about a regionally hosted instrument for delicate data
Third-party menace intelligence
In case you take part in any Data Sharing and Evaluation Facilities (ISACs), subscribe to industrial feeds or recurrently make the most of bulletins and blogs geared in direction of your business, you can too make the most of their indicators in Cisco Safe Community Analytics. They work the identical manner we dealt with inner menace intelligence within the first a part of this weblog or Cisco Talos blogs proven above. Watch out when scraping menace intelligence to make sure you might be solely together with indicators you plan to make use of. For instance, in case you are scraping a whole bulletin that incorporates IP addresses you have an interest in, be sure you don’t by accident copy an IP handle from an adjoining and unrelated entry.
You may paste a block of IP addresses right into a New Host Group or use a instrument to drag them out of a block of textual content after which paste them. Watch out in case your supply defangs IP addresses, as this is quite common. You should utilize the identical methods I illustrated for the Cisco Talos GitHub entries above.
Host group dad or mum/little one relationships
A superb follow for constructing dad or mum and little one host teams is to create a brand new dad or mum host group for any distinct sources. Then create a baby host group for every new report. This lets you simply observe again each to the unique supply or the menace intelligence and determine which marketing campaign or menace actor is concerned. I like to incorporate a hyperlink to the supply within the host group description. That is particularly useful in case you are using a number of menace intelligence sources on your safety controls. Set up your host teams in a fashion that makes essentially the most sense to you.
You may both create a brand new Customized Safety Occasion (see the primary a part of this weblog) for every little one host group with a definite title or create one Customized Safety Occasion for the dad or mum host group with a generic title. Both case can have you lined, and the host group title within the alarm will allow you to shortly determine the supply of menace intelligence.
Different Concerns
You all the time need to carry out a Circulation Search (Examine -> Circulation Search) first earlier than constructing any Customized Safety Occasions. It will forestall you from flooding your self with alerts in case you by accident embody the unsuitable IP handle or are already recurrently speaking with an IP handle you plan to incorporate in a brand new host group.
We’d love to listen to what you assume. Ask a Query, Remark Beneath, and Keep Related with Cisco Safe on social!
Cisco Safety Social Channels
Share: