This weblog is continuation of the earlier weblog on utilizing Cisco Safe Community Analytics. On this half, we cowl leveraging public Cisco Talos blogs and third-party risk intelligence information with Cisco Safe Community Analytics. You should definitely learn the primary half as this half makes references again to Host Group and Customized Safety Occasion directions coated within the authentic weblog.
Cisco Talos Blogs
The proficient researchers at Cisco Talos often publish blogs on threats and vulnerabilities. These blogs break down the techniques, strategies and procedures (TTPs) utilized by risk actors. Talos’ analysis publications usually embody pattern supply code, phishing emails, reverse engineering of malicious binaries, instruments, scripts, command and management methodology, attacker infrastructure, file hashes, domains and IP addresses utilized in malicious operations. The symptoms of compromise (IOCs) are printed on GitHub as JSON and plain textual content information. We will use these blogs and GitHub information to construct Customized Safety Occasions in Cisco Safe Community Analytics.
Let’s take a look at a weblog: MoonPeak malware from North Korean actors unveils new particulars on attacker infrastructure. This weblog focuses on a state-sponsored group from North Korea. The group leverages an open-source distant entry trojan (RAT) from a household being known as MoonPeak.
Scroll via the article and take note of the extent of element offered. Close to the very backside of the weblog discover the part titled IOCs.
Click on on the hyperlink to the GitHub repository. You can be taken to the Cisco Talos GitHub repository the place you will see that the IOCs can be found as JSON and plain textual content information, and are sorted by the month the weblog was printed in. Be at liberty to discover different information, months, and years to get aware of the symptoms often offered.
Click on on the file “moonpeak-infrastructure-north-korea.txt” or observe the direct hyperlink. Scroll all the way down to line 35 of the file the place the Community IOCs start. This checklist incorporates twelve IP addresses we’re occupied with. Observed that the IP addresses and domains have been defanged with sq. brackets across the dots so you can’t by chance click on on them.
You possibly can both manually delete the sq. brackets or use the discover and exchange performance in your favourite textual content editor to do the job. I choose to make use of Notepad++ when coping with textual content information. I set the “Discover and Exchange” to search for the sq. brackets across the dot and exchange all situations with a dot.
Delete the domains from the checklist and duplicate and paste these IP addresses right into a New Host Group utilizing the strategies described within the first a part of this weblog.
You might also think about using a device to extract IP addresses from textual content. I actually like iplocation IP Extractor. You possibly can paste in a block of textual content with IPv4 and IPv6 IP addresses and it’ll extract them to allow them to be simply reviewed and pasted into a number group. The IPs you paste into this device can’t be defanged. It requires full and proper IP addresses to work.
All the time take into account the sensitivity of the knowledge you present to public instruments earlier than utilizing them. It’s best to take into account a regionally hosted device for delicate info
Third-party risk intelligence
In case you take part in any Data Sharing and Evaluation Facilities (ISACs), subscribe to industrial feeds or often make the most of bulletins and blogs geared in the direction of your trade, you may also make the most of their indicators in Cisco Safe Community Analytics. They work the identical method we dealt with inner risk intelligence within the first a part of this weblog or Cisco Talos blogs proven above. Watch out when scraping risk intelligence to make certain you’re solely together with indicators you plan to make use of. For instance, if you’re scraping a complete bulletin that incorporates IP addresses you have an interest in, ensure you don’t by chance copy an IP tackle from an adjoining and unrelated entry.
You possibly can paste a block of IP addresses right into a New Host Group or use a device to tug them out of a block of textual content after which paste them. Watch out in case your supply defangs IP addresses, as this is quite common. You should use the identical strategies I illustrated for the Cisco Talos GitHub entries above.
Host group mum or dad/youngster relationships
A superb apply for constructing mum or dad and youngster host teams is to create a brand new mum or dad host group for any distinct sources. Then create a baby host group for every new report. This lets you simply monitor again each to the unique supply or the risk intelligence and determine which marketing campaign or risk actor is concerned. I like to incorporate a hyperlink to the supply within the host group description. That is particularly useful if you’re using a number of risk intelligence sources on your safety controls. Arrange your host teams in a fashion that makes probably the most sense to you.
You possibly can both create a brand new Customized Safety Occasion (see the primary a part of this weblog) for every youngster host group with a definite title or create one Customized Safety Occasion for the mum or dad host group with a generic title. Both case may have you coated, and the host group title within the alarm will enable you shortly determine the supply of risk intelligence.
Different Issues
You at all times wish to carry out a Movement Search (Examine -> Movement Search) first earlier than constructing any Customized Safety Occasions. This may stop you from flooding your self with alerts should you by chance embody the unsuitable IP tackle or are already often speaking with an IP tackle you plan to incorporate in a brand new host group.
We’d love to listen to what you assume. Ask a Query, Remark Under, and Keep Related with Cisco Safe on social!
Cisco Safety Social Channels
Share:
