GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → lion-gu → Ioc Explorer

lion-gu / Ioc Explorer

Licence: mit
Explore Indicators of Compromise Automatically

Programming Languages

python
139335 projects - #7 most used programming language

Labels

security-toolscybersecurityincident-responsethreat-huntingthreat-intelligencesecurity-automation

Projects that are alternatives of or similar to Ioc Explorer

Patrowldocs
PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform
Stars: ✭ 105 (+43.84%)
Mutual labels:  incident-response, security-tools, threat-hunting, threat-intelligence, security-automation
Patrowlmanager
PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform
Stars: ✭ 363 (+397.26%)
Mutual labels:  incident-response, security-tools, threat-hunting, threat-intelligence, security-automation
Patrowlengines
PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform
Stars: ✭ 162 (+121.92%)
Mutual labels:  incident-response, security-tools, threat-hunting, threat-intelligence, security-automation
YAFRA
YAFRA is a semi-automated framework for analyzing and representing reports about IT Security incidents.
Stars: ✭ 22 (-69.86%)
Mutual labels:  incident-response, cybersecurity, threat-hunting, threat-intelligence
Watcher
Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.
Stars: ✭ 324 (+343.84%)
Mutual labels:  incident-response, cybersecurity, threat-hunting, threat-intelligence
Intelowl
Intel Owl: analyze files, domains, IPs in multiple ways from a single API at scale
Stars: ✭ 2,114 (+2795.89%)
Mutual labels:  incident-response, security-tools, threat-hunting, threat-intelligence
Vuls
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
Stars: ✭ 8,844 (+12015.07%)
Mutual labels:  security-tools, cybersecurity, security-automation
Malware-Sample-Sources
Malware Sample Sources
Stars: ✭ 214 (+193.15%)
Mutual labels:  cybersecurity, threat-hunting, threat-intelligence
Spiderfoot
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
Stars: ✭ 6,882 (+9327.4%)
Mutual labels:  cybersecurity, security-tools, threat-intelligence
Azure-Sentinel-4-SecOps
Microsoft Sentinel SOC Operations
Stars: ✭ 140 (+91.78%)
Mutual labels:  incident-response, threat-hunting, threat-intelligence
MindMaps
#ThreatHunting #DFIR #Malware #Detection Mind Maps
Stars: ✭ 224 (+206.85%)
Mutual labels:  incident-response, threat-hunting, threat-intelligence
AutonomousThreatSweep
Threat Hunting queries for various attacks
Stars: ✭ 70 (-4.11%)
Mutual labels:  cybersecurity, threat-hunting, threat-intelligence
Sentinel Attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
Stars: ✭ 676 (+826.03%)
Mutual labels:  security-tools, cybersecurity, threat-hunting
ThePhish
ThePhish: an automated phishing email analysis tool
Stars: ✭ 676 (+826.03%)
Mutual labels:  incident-response, cybersecurity, threat-intelligence
censys-recon-ng
recon-ng modules for Censys
Stars: ✭ 29 (-60.27%)
Mutual labels:  cybersecurity, threat-hunting, threat-intelligence
Misp
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
Stars: ✭ 3,485 (+4673.97%)
Mutual labels:  cybersecurity, threat-hunting, threat-intelligence
Besafe
BeSafe is robust threat analyzer which help to protect your desktop environment and know what's happening around you
Stars: ✭ 21 (-71.23%)
Mutual labels:  cybersecurity, threat-hunting, threat-intelligence
Mthc
All-in-one bundle of MISP, TheHive and Cortex
Stars: ✭ 134 (+83.56%)
Mutual labels:  incident-response, threat-hunting, threat-intelligence
SyntheticSun
SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats.
Stars: ✭ 49 (-32.88%)
Mutual labels:  incident-response, security-automation, threat-intelligence
Threatingestor
Extract and aggregate threat intelligence.
Stars: ✭ 439 (+501.37%)
Mutual labels:  security-tools, threat-hunting, threat-intelligence
View All Similar Projects ➔

IOC Explorer - Explore IOCs Automatically

illustration

Introduction

Correlating Indicator of Compromise (IOC) is a key part of incident investigation even threat hunting. Finding one IP address hosting several known malicious files would help SOC teams to implement more effective countermeasure by blocking that IP address. However, building a correlation usually means a lot of manual work, like searching multiple IOCs across different threat intelligence sources (community sources or private sources). Sometimes, correlation can only be found after several iterative queries.

IOC Explorer aims to execute iterative queries across multiple threat intelligence sources automatically. It may assist security analyst to find more clues for investigation.

Requirements

IOC Explorer is written in Python 3. It is not tested in other Python versions.

Please make sure you have installed following libraries prior to start:

  1. requests 2.20.1
  2. anytree 2.4.3

Quick Start

  1. Open config.ini file, and type in your API Key of VirusTotal or QiAnXin_TI section
  2. Open ioc.csv file, and type in your query IOC (eg., 'domain, xnz.freetzi.com')
  3. Run the tool in command line
$python explorer.py
  1. Go to './results' directory to check your query result

Usage in Details

Initial Configuration

There are some settings to configure before first run. Basiclly, all settings stored in 'config.ini' file can be splitted into two categories: query behavior setting and threat intelligence setting.

'depth' setting in 'general' section is an important query behavior setting. It defines the times of iterative queries, which will query intelligence sources based on IOCs returned on previous queries. Default setting is 'depth=3'. If user increases the value, the tool carries additional queries on previous returned IOCs.

Each threat intelligence has its own but different settings. However, API key is the most common setting for intelligence sources, which is also required.

Input IOC

Currently, 4 IOC types are supported, namely as followings,

  • email address (ioc_type='email')
  • file hash (ioc_type='file') Note: md5/sha1/sha256 are supported
  • ip address (ioc_type='ip_address')
  • domain name (ioc_type='domain')

CSV file (by default, ./ioc.csv) is the place to input IOC for query. The CSV file has following format for data,

IOC_type, IOC_value

For example,

domain, xnz.freetzi.com
file, c0531f812a1ec5e825f7250f7b52db7621ecf93d973f0e3ba1aa0372e0f559f2
email, [email protected]
ip_address, 192.99.142.235

Output Result

After querying multiple threat intelligence sources, IOC Explorer will collect all returned IOCs and output them in a well-organized way.

This tool supports two output formats: plain-text and JSON.

IOCs in plain-text is organized in tree style, like followings:

AnyNode(id='[email protected]', type='email')
├── AnyNode(id='qq758.com', relation='QAX: Whois email to domain', type='domain')
│   ├── AnyNode(id='[email protected]', relation='QAX: domain to whois email', type='email')
│   │   ├── AnyNode(id='ltcp3.com', relation='QAX: Whois email to domain', type='domain')
│   │   ├── AnyNode(id='lzskqc.com', relation='QAX: Whois email to domain', type='domain')
│   │   ├── AnyNode(id='df796.com', relation='QAX: Whois email to domain', type='domain')
│   │   ├── AnyNode(id='mir900.com', relation='QAX: Whois email to domain', type='domain')
│   │   ├── AnyNode(id='888hl.com', relation='QAX: Whois email to domain', type='domain')
│   │   ├── AnyNode(id='jiemianpaomo.com', relation='QAX: Whois email to domain', type='domain')
│   │   ├── AnyNode(id='qx969.com', relation='QAX: Whois email to domain', type='domain')
│   │   ├── AnyNode(id='c888c.com', relation='QAX: Whois email to domain', type='domain')
│   │   ├── AnyNode(id='982307.com', relation='QAX: Whois email to domain', type='domain')
│   │   └── AnyNode(id='ac0028.com', relation='QAX: Whois email to domain', type='domain')
│   ├── AnyNode(id='47.91.202.66', relation='VT: domain to resolution ip', type='ip_address')
│   │   ├── AnyNode(id='4bf7e7e6c78c1a69def4beef216ad52dbabae1f831f49067e3b29f8a7a62d71e', relation='VT: IP to downloaded file', type='file')
│   │   ├── AnyNode(id='e682dfcdde010f6e15bae0d843696f6ae8d5a85e75441660b782789ee747f075', relation='VT: IP to downloaded file', type='file')
│   │   ├── AnyNode(id='88f089e2e069ca698fa498fb5ba5f46fd95d3c8ee5b4c5c6587eae8d2db43fe7', relation='VT: IP to downloaded file', type='file')
│   │   ├── AnyNode(id='39a75a83af8d38202ab05de7ac9beae6e00d21501867601cc2a86094c79d6f16', relation='VT: IP to downloaded file', type='file')
│   │   ├── AnyNode(id='1630ab0121c4df64230045ef86ee54e5ee05bd371c2b3c26bcdb0ef3a0d2360f', relation='VT: IP to downloaded file', type='file')
│   │   ├── AnyNode(id='7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402', relation='VT: IP to downloaded file', type='file')
│   │   ├── AnyNode(id='9b342ae7f25d65bdb817d8c995f3211ac398e41575fc5d149d994c1dcb008f0a', relation='VT: IP to downloaded file', type='file')
│   │   ├── AnyNode(id='39d6bba9f294f11f84933e48483aff12a9efc5c7d6eb4f57a8d36ef8bd71823e', relation='VT: IP to downloaded file', type='file')
│   │   ├── AnyNode(id='d37608c9b93ae18c5ed5d376e32449f95358f708a35cd8b06431ca2be733f87e', relation='VT: IP to downloaded file', type='file')
│   │   └── AnyNode(id='fb7595b2d6f1cc89cca75ec06186c228274e95fb6c3e233e8de2e804284ab8c1', relation='VT: IP to downloaded file', type='file')

Default output directory is './results'. Filename follows this naming rule: {ioc_value}depth{depth_value}_{timestamp}, like '192.99.142.235_depth_3_201907171110.txt'

More sample results are given in './samples' directory for reference.

Threat Intelligence Sources

A plenty of TI sources exist in cybersecurity field. As a start, IOC Explorer supports following sources:

  • VirusTotal, both public and private data available
  • QiAnXin, only private data

A summary of IOC relations is following,

Source Type Relation Explanation
VirusTotal Public and private Ip -> file Files downloaded from the IP address
VirusTotal Public and private Domain -> file Files downloaded from the domain
VirusTotal Public and private Domain -> ip DNS resolutions for the domain
VirusTotal Public and private File -> ip IP addresses contacted by the file
VirusTotal Public and private File -> domain Domains contacted by the file
VirusTotal Public and private File -> file Files that executed the file
QiAnXin Private Domain -> ip DNS resolutions (A record) for the domain
QiAnXin Private Domain -> email Registrant email for the domain in Whois record
QiAnXin Private Email -> domain Domain names registered in the same email
QiAnXin Private File -> ip IP addresses contacted by the file
QiAnXin Private File -> domain Domains contacted by the file

You can can contact me for public available sources. Or you add your private sources by yourself.

Future Plan

During tests, some known good IOCs (like CDN ip addresses) are listed results. If there is a tag attached to the IOCs, that would bring additional hints for analysis. But such data enrichment requires more reliable data sources. Searching data sources is one (probably long-term) item of future plan.

Any ideas or suggestions are appreciated, and feel free to contact me: [email protected]

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].