In information security, the ability to predict and adapt to the behaviors of criminals can help organizations improve defense strategies against cyber threats.
We can do this through the use of threat intelligence where data comprised of past and current indicators of compromise (IOCs) is analyzed to block access to malicious resources, to alert about security breaches, and for threat hunting initiatives, among other initiatives.
Organizations usually outsource IOC feeds from Threat Intelligence Data Providers, aggregate them with other resources, and integrate them using Threat Intelligence Platforms.
To better understand these concepts, let’s dig deeper and discuss these two terms commonly interchanged by many.
What is a Threat Intelligence Data Provider?
A Threat Intelligence Data Provider is an entity that maintains feeds of indicators of compromise. The data in these feeds is gathered across a global landscape of spambots, honeypots, sandboxes, data sharing, crawlers, and many other sources to cover as many malicious campaigns as possible.
Data from threat intelligence providers is used to help enterprises strategize security measures according to their business goals. It is important to notice that the outcomes of all initiatives derived from threat data will be as good as the IOCs consumed.
Therefore, choosing a dependable Threat Intelligence Data Provider is a critical step.
What are some examples of IOCs?
Command & Control addresses + MITRE ATT&CK
Most malware and ransomware families utilize command and control (C2) systems to gather instructions on which institutions to target, and relay stolen data and credentials, such as exchange encryption keys.
Through C2s the hackers control the entire botnets of infected computers. Most often than not, traffic to C2s is encrypted and disguised as regular Internet communication.
DNS-over-HTTPS (DoH) Resolvers
DoH, or DNS over HTTPS (RFC 8484), is a relatively new protocol that provides increased privacy and security. It does this by encrypting DNS queries and responses, which prevents eavesdropping and man-in-the-middle attacks.
Instead of using a regular DNS resolver, queries are encrypted and sent to a DoH-enabled server, making them indistinct from web traffic. Unfortunately, this means that DNS Firewalls are bypassed, private hostnames may be leak, and incident response and threat hunting become far more complex.
This way, tech support troubleshooting changes significantly. Since, now applications and the operating system use distinct resolvers, among other issues.
Anti-Mining
Cryptocurrency mining, also known as crypto mining, is the process responsible for verifying transactions from a public ledge and consequently creating new coins. Hackers lure their targets by getting them to click on a malicious link in an email that loads crypto mining code on the computer. They also do this by infecting them with Javascript code that uses the victim’s browser and computer resources for mining without the users’ consent.
What is a Threat Intelligence Platform?
A Threat Intelligence Platform (TIP) is a solution that organizations use to aggregate multiple threat data feeds, conduct event correlation and analysis, and perform adversary profiling.
Traditionally, analysts have to discern a large number of alerts into valid and false positives. With TIP, information gathered from multiple resources is analyzed within the platform. This way, it can give security teams more time to focus on incident response and proactive prevention strategies.
In addition, It usually integrates with Security Information and Event Management (SIEM) or Security Orchestration, Automation and Response (SOAR), and a ticketing system to perform event correlation and generate alerts for the incident response team.
Key Functions of TIP
Aggregation of Threat Intelligence Data
You can find Threat intelligence data feeds in different formats, including CSV, JSON, and STIX.
Apart from external resources, enterprises must also include internal sources. Such as network logs. A TIP then is in charge of the aggregation and deduplication of the data.
Threat Analysis
Together with the SIEM, TIP analyzes the threat indicators to sift through the data and remove information that isn’t relevant. Then, it sorts the data into valid threats and eliminates false positives. It also profiles analyzed information into potential threats as it tries to find patterns from historical data. Some TIPs also have risk-scoring capabilities.
Incident Response
In the event of an attack, the platform triggers a workflow that responds to the threat, while allowing human intervention when needed.
How Can We Help?
Malware Patrol offers a wide variety of IOC feeds for commercial and research purposes.
The data we provide is, verified by our cybersecurity experts to lay out actionable indicators and protect customers against malware infections and data breaches.
For ease of use, the feeds are formatted for compatibility with the common threat intelligence platforms in the market. To know more, you can contact us and our cybersecurity experts will get in touch with you.
Andre Correa
CEO, Malware Patrol