Tootfinder

I just pushed a new misp-module to support PTR classification on hostname and IP addresses in MISP.
🔗 MISP modules available #cti #threatintel #threatintelligence #cybersecurity

Looks like #adform got compromised. It is shipping a malware-laced tracking script that is replacing crypto wallet addresses in the users clipboard. Recommend disabling adform includes in your websites. Sample: #IoC - C2 Address and Port seems to be 84.32.102.230:7744 .
#threatIntel

Doing some statistics on the persistence of information published on security and threat intelligence blogs. A surprising number of the domains in the list below are NXDOMAIN nowadays.
Don't assume that security information and threat intelligence will remain accessible over time, especially when it is hosted by large private entities.
Some are simply mistyped, while others reflect DNS changes over time that eventually left the original URLs broken.
Stability and persistence of information is hard on Internet.
#threatintelligence #threatintel #infosec #cybersecurity

  app.response.ncr.com
  blog.0x3a.com
  blog.anomali.com
  blog.cert.societegenerale.com
  blog.cylance.com
  blog.deniable.org
  blog.ioactive.com
  blog.jpcert.or.jp
  blog.kleissner.org
  blog.malwareclipboard.com
  blog.malwaretracker.com
  blog.passivetotal.org
  blog.safebit.mn
  blog.team-cymru.org
  blog.zimperium.com
  blogs.rsa.com
  cdn.securelist.com
  community.saas.hpe.com
  ddos.arbornetworks.com
  dnsdb.isc.org
  edu.arabsgate.com
  info.baesystemsdetica.com
  info.isightpartners.com
  insider.domaintools.com
  ioc.forensicartifacts.com
  iranthreats.github.i
  joedd.joesecurity.org
  lab.anchiva.com
  labs.alienvault.com
  labs.lastline.com
  labs.snort.org
  labsblog.f-secure.com
  luminosity.link
  malware.sekoia.fr
  morphick.net
  motherboard.vice.com
  ocelot.li
  permalink.gmane.org
  r.virscan.org
  remchp.com
  research.riskiq.net
  resources.infosecinstitute.com
  sandbox.deepviz.com
  sec.sexy
  securityblog.s21sec.com
  securityblog.switch.ch
  securitydaily.org
  sub0day.com
  tif.mcafee.com
  wepawet.iseclab.org
  www.cve.mitre.org
  www.cyintanalysis.com
  www.cyphort.com
  www.icebrg.io
  www.infosecdailynews.com
  www.isightpartners.com
  www.lexsi.com
  www.novetta.com
  www.packetmail.net
  www.root9b.com
  www.skycure.com
  www.threatexpert.com
  www.vxsecurity.sg

Rulezet and its ecosystem: how detection rules travel between tools.
Vulnerability-Lookup, AIL, Flowintel, MISP, Velociraptor and more: every tool that reads from Rulezet or receives its rules, what each connection does, and an interactive map of the whole ecosystem.
🔗 #threatintelligence #threatintel #rulezet #misp #opensource #cybersecurity #detectionengineering #flowintel #velociraptor #dfir

Recommendations on Naming Threat Actors.
The MISP standard has been updated including the new tracking of naming origin from security vendor.
#cti #threatintelligence #soc #cybersecurity #threatintel
🔗 https://www.misp-standard.org/rfc/threat-actor-naming.html#name-misp-galaxy-threat-actor-na

MISP Galaxy Threat Actor Explorer v1.0.0 released
#cti #cybersecurity #misp #threatintelligence #threatintel
@…

CCWget is a lightweight Python client for searching and retrieving archived web objects from a CIRCL Common Crawl indexing service.
@… did a pretty cool tool to search the Common Crawl. The service is quite resource intensive but if you are a security researcher, you could get access.
#cybersecurity #commoncrawl #cti #threatintel
🔗 https://github.com/ail-project/CCWget