Hello and welcome to a new video on
the section of cyber threat intelligence and dark web
section 4.
In this video we will do a demo about
the threat intelligence tools and the
platform. So let's get started.
So the tools that we will cover in this video crowdstrike
falcon, Recon.
Recorded future Casper Sky intelligence, Alien Vault
open threat exchange Cisco Tyler's intelligence,
Miss. Urlscan.io abuse
ipdb bleach directory check
leaked until ixl.io.
So these are tools and some of
them are platforms are paid platforms. The first
three are paid.
So in the first two I will only share screenshots
sadly. I won't be
able to give you a full demo about them because it's a paid one.
It needs license and I can't use my
own account in this course for the NDA
and stuff.
So let's stick with the screenshots
and we will also I will also share
with you how to use the rest of the tools. They are
free and some of them are open source.
So let's get started. So in the first one, it's
a screenshot for crowdstrike. f***
and Recon ax.
So this is how the Cyber threat
intelligence platform looks like.
And so we have alerts like selling
Network full access domain admin as we can
see the the intelligence feed we have
also selling Network full access selling all
of them are related to selling Network
for Access domain. Admin.
Country USA ad user
for thousandth Revenue 80 million dollars. So
it's an alert just to monitor the
selling Network full access domain admin if
there's something exposed or something like that. So you got so you
will get a notify about the so you
can use the same thing with the crowdstrike but
with different stuff you need to make sure
you have the monitor you needed and the things
that you will only focus on and this is a dashboard that
will help you also to identify and interact.
So this dashboard is
about diagrams and most interacted with on
phone exploit in the last year.
moving on with the next screenshot
Here I will show a small demo.
About recorded Futures since I have access to
it.
So this is what a recorded future dashboard looks
like you have all the alerts that you set. So
here we have if alert the
related to supplier Mansion everything related to
the supplier cyber Espionage that exploits root
Goods Global vulnerability risk vulnerability is
domains code repository IP address mentioned industry
risk apt 37 here.
I'm focusing on aptc 37
But brand mansions to protect the brand so
brand Mansions is someone talking about my
brand about my company and something
related to covid-19 because you
know in the last three years covid-19 was a huge themes here
the inside group research.
It's a team for recorded future where they
share the latest threat report threat updates
here. Also, they share tools
and ttps on the left as you can see.
A Windows brought for slogan tool shared on GitHub. So
all of them we check these alerts we do
it the threat analysis and based
on that. We contact the client whenever something we have.
So here I was trying to do a research
about the corona.
Teams, I'm taking the covid-19 teams the
specially when it comes to fishing because there's a
lot of fishing tough related to the covid.
So in the search and recorded future you can involve Corona and
domain.
Or covered in domain and virus and
domain or 19 and the event.
It's between the last two weeks and the next two weeks
and the source. I need the source type to be
only domain related or they're an as technical reporting
and screenshot on the right side.
You can see what the recorded future will tell us
everything related to TTP flash report
Yara rules that will help you to you and
the sock team to to add
these rules and to Monitor and identify this
kind of threats in your
environment with your clients
you have fret read.
Geopolitics cyber threat analysis and all these
information that we that's useful for
us.
to conduct the analysis
So here we have the attacking vendor
the country malicious hashes URLs
apt who's the APT behind us
was doing this fishing stuff. What products
are affected what malware is being
used the mighty attack the techniques in the mighty
attack? Like here. We have t 1 0 82 system
information discovery.
and a technology Dot lnk
These are the text Sidewinder campaign
delivering. Malicious Island. KFI using
covid-19.
Lots of stuff also here and the end we have the hashes also.
An example about how we can check about the
dark web. So here recorded future can
give you also the recent dark web preference.
So here we have 100 x new volume
down 10 milligram coronavirus free.
So it's something suspicious. It's
a product. It's a drug being said sold on
the dark web. So this scenario
it can be used the same for other
purposes like searching for credit cards searching for
anything related. It can be IP we
can search for hashes. We can search based on
apt we can search based on malware any you
just need to think outside the box and you
will find anything you need the most probably
So in the next screenshot I'm showing how alerts
and is being
added. So here we have let's say payment and
banking monitoring. So here you monitor everything
related to banking vulnerabilities payments domains
on code repository. If is my
domain on GitHub. Let's say mentions of
service disruption as someone talking about my brand
on mainstream sources on
basement. Let's say infrastructure watch
list cyber event affecting my
everything relates to Brand protection. These are
alerts to I notify us if something
if there's one abilities or harm to our brand
it could be someone talking about that. It could
be a bad reviews. So it's more than
just affordability.
It's the whole package as they say and the right
side is just for banking related and
as we can see there's a tick on email. So
every notify everything we have it
will be email to us.
So let's continue with the rest
of the tools.
And the rest of them I will show the a demo
not screenshots about all of the rest.
So let's get started.
Okay, we have here Casper
Sky threat intelligence portal.
So here you can do lockup final
analysis web address analysis anything.
So it's a small or
like a demo version of the Casper Sky
threat intelligence.
This is the
open tip.
It's a demo. You can't use the whole package. Just
you can do like fire analysis and lock up.
So here I did I look up for this IP. It's a
Russian IP. It's known for denial of service
attacks. These are the range. That's
the net name address role contact. So
Geographic
Also, you can upload as we said.
So it's really important to
use this.
Tool so here we have the top 10 countries
the top 10 detected threats. So we
have the transition ransomware clip John.
This is 30%
Globally, we're talking globally.
So we have mainly all of them are run
somewhere.
Afghanistan circumstan Yemen Isla
Islamic Republic of Iran Pakistan Bangladesh
Rainier
Korea and the Republic of China and Syrian
Arabic Republic. These are the top 10 happening now
so we can see around somewhere exploits.
So here the top 10 exploits and
the countries again.
web threats
spam
and so on so all of these information you
have and that you need to analyze or
look up or check this on a
daily.
Routine, it's really helpful. It will
give you insights about what's happening. What's
or what are you analyzing? Is
it suspicious or not? So it's really important to have
these.
And I really recommend using this tool.
Moving on to alien volt. So
alien volt it's our open.
Threat exchange it's free to use.
Anyone can use it. They just create an account.
It's free and
so basically Alien Vault, it's
it lets you share fret intelligence
and see what's happening
like
Indicators you can see the indicator. So here are
the latest.
indicators
Obviously all of them are suspicious.
So we have IPS, we have hashes domains emails
and you can filter let's say
I need email so you can check emails.
That will take a bit of time because there's a lot of data. So
here we have.
Malicious emails and you can check for
the role.
So it's really important to use the Alien Vault specially because
it's free and it would it's providing you thread data
for fully for free and also you can
subscribe to its newsletter. So
it will notify you by email every alert
everything like a new
what's happening. So it's really good also to subscribe to
that.
so you can check like adversaries which is
apts and
a check every one of them.
What's new what's happening Industries? You
can check by industry malware families
all the malware's.
groups users
and the pulses obviously
So here's the pulse is basically to do a study. So
it's like creating a group and
like a small community and you can share the stuff about
it.
It depends what the topic is here. It's
like Port scanners other attacker Honey
Nut.
Just out of the box stuff.
Next we have the Cisco Talos threat intelligence.
This is a demo tool. It's not
a full tool. You can check by geography. What's
happening. What's the malware's IP address like this
is in USA.
Some malware hostname IP address here. We
have also stuff here.
And you can look up the lockup by IP domain
or network owner. So let's say I need to search for
this IP.
Just a moment. Okay, so it will
give you details about this IP if it's
malicious it's saying it's poor. So obviously it is.
Because this IP is known for DDOS attacks.
This is the volume. This is the who is some information
about it.
And so that's it. So yeah Russian.
Okay.
So here also you can check the latest vulnerability
reports by Cisco, Dallas.
And zero days this Cloud vulnerability. It's good also
to
view them read them and keep
in mind everything. I'm nothing you see
now. This is all can be automated on one tool
to make your threat study easier
easier day by day.
Here we can scan. Also if I need to scan a
website it can be scanned here.
So here urlscan.io you can
like.
Ask scan.
URLs domains so you can check let's
check this for example.
So it checks everything about the URL
the behavior the indicators,
so this is the indicators.
links
and what's happening and if there's some comments about it also
and it renders the what age
so it's really amazing to to do a
URL scan and to know if it's a clean website or not.
Obviously, it doesn't seem
a good website what the one
I'm showing now.
So it's important to check the stool and use
it on the databases.
Next we have abuse IPTV. So basically
it's a tool just to tell you about the
um, the malicious IP
address of the IP is malicious. So
it's like database for all the
suspicious IP address. So basically just type the
IP address assuming it's this
And it will tell you that this IPA was
found in our database. It was reported 38060 times
confidence 100% So it's
a digital ocean IP. It's data center web hosting
Transit.
but it's
and it's being used for
growth Force. Obviously. We're Brute Force attacks web
attacks hacking.
For and and many many that reported this
IP.
So yeah, that's it's really amazing to use this kind
of intelligence to to know
more and more about our
about the threats
we have.
Next we have the abused.ch. So basically
abuse CH provide platforms to
about the latest threat
updates
In this and this demo, I will show
you the malware and URL but you're free to
check the rest like dayada one. It's really
important because because it will give you Yara rules to
analyze the the analyzed the
malware's or analyze
the things that you want to analyze basically are in a
small definition. It's a Swiss army knife tool.
Pattern that analyze a file
on a specific rules. Let's
say you need to search on
for a
specific string in a file. So you
are at will help you to do that.
It can be automated it can scan.
More than one file it can check a lot.
So there's a lot of you amazing here also discover
and sometimes Yara, it's even more
advanced from antiviruses because
you're creating the other rule your writing it.
To detect a specific file. Like let's say you have
a Yara role that detects one acry run somewhere.
So
and your role it's well optimized so
it will detect one authorized easily. So this
is a database for the other rules.
So let's check URL house. So basically this is
a provide us the latest
threats the latest Intelligence on the suspicious
URLs as we can see we
have these and these there's a lot
so some of them are online some of
them are offline. So this is a webshell.
Here we have 32-bet yellow
of mozio lots of line. So all of them are
malicious.
So we can search and check if let's
say you're doing a threat
research and you need to check if you if
the IP is part of these it's like
the abuse IPTV, but it's for URL.
So you can put the URL and check it.
Same thing when the manual so this is a database
with the latest malware.
Okay, so this is a webshal malware. This is the
hash.
The type is unknown. We have redliner sticker
exe. So this is the latest malware.
And there's people who are reporting at also.
You can to down you can download it as a sample.
Not for.
not for
not for the mindset that we need to attack. Someone is just for
from a side that you need
to make an analysis and send box the
smaller.
In the next tool we have breach directory.
and it's it's a
tool that will tell you if your
username email or phone are part of a
data breach
and it will show you.
If if you are part of data breach it will
show you the exposed password, which is
insane, but not all of it.
There is platforms that shows you the full password.
I guess for example the hash it does it.
But with each directly as a demo version,
I guess it shows you the first three letters.
But that but this provides a good insights. So
let's take dust at gmail.com.
but searching
Usually it doesn't take time.
as much
as this that's that at gmail.com. It has
some data breach. Let me show you that and another
tool.
This is a checklist.cc. That's also a
tool like Bridge directory. It's but it's kind of
more advanced because it gives you more data.
So here I put the test at
gmail.com.
And we have but the password is hashed. It
doesn't show us the password.
Maybe if we have the full version and tell us the password.
And it shows you the exposed IP address and the
source and many many
more so test at gmail.com as part of
huge data breaches many
many websites.
These are usernames password.
Name and some of ips also
you can download and repo and and you
can have a report.
Let me refresh this page,
maybe it will work
Okay, so these are the passwords.
Let me close this.
So as you can see, I check test@gmail.com. This
is the hash.
But if you crack the hash if you
were able to crack the hash you can see the full password.
But this is the password.
So we got the first three or four letters.
Some of them we have the full password.
So yeah.
So here the passwords are but here the
passwords are shown. So these also
good tools to help us
in the threat intelligence.
And we can check if we have
some.
exposed credentials
So here we have a data
breach. This email is part from WWE web
host.
1 2 3 RF 177171 13
it's a weird websites.
Adecco we have Adobe we have
Animoto Apollo happened lots
of Audi
baby names lots of lots of
websites
one of my
favorite tools. It's intelligence acts sadly
intelligence Acts.
It's bit limited. You need to buy the
license to enjoy the full potential of it intelligence
acts you can.
You can check data that's being exposed online.
So intelligence exit it index a
huge amount of data and you can
download it. Also, let's say you have a
data breach.
For an X company and intelligence acts
might find it for it and you can also download it.
And you can check domains URLs in my
email IPC IDR Bitcoin Addison more. So let's
say I will put test.
at gmail.com
you will cut you will get a lot of stuff like this
60 million mix DB lines. That
does View.
um
So I guess we need to put the
full version to view it.
Um, so yeah, so as you can see we have
lots of stuff.
Maybe the the things we
saw now since we have some intelligence data.
Maybe we can find these as a
full password in these
exposed databases.
But as you can see, we need the pro membership to view them.
So I told I told us on sorry.
Okay.
first
a gmail.com
so we have found 100 text by
1000 text files websites Bates.
Csv4 is database. So obviously an email
so obviously obviously we have the full password
that and for password of
those and until axel.io. So, but
we need the full version sadly.
so yeah, but you can
use it for many purposes that will help you in conducting
the research, especially when comes to hackers and many many
minutes of
um, yeah, and you can type literally anything.
I guess you can type Netflix, so that's
it's not working anymore accounts.
It's not working and usually usually it does work.
Ah, but yeah.
So I really recommend the store and if you're able
to get the pro version and don't hesitate.
Here we have another tool. It's
a up. It's a threat exchange platform
like alien volt, but it's called opencityi. It's
really really famous one.
It's used also by governments.
It's an open source. It's on GitHub. You can
contribute to it. You can add your own intelligence same
as Alien Vault.
And these data are demo. It's not
a real account this so demo dashboard
as you can see here. It's demo.
So you can check the latest test the latest activities what's
happening that could have
where are the most of the threats like
here? It's in United States. So it's
a it's a really good tool and
I recommend for you to create an account and to
view some stuff on it.
lastly I want to share miss miss
a Miss is
a
a threat intelligence platform that's like recorded
future and Kasper sky, but
it's an Open Source One.
That's free. Anyone can download it.
from GitHub and you can install it
and
And use it so here we have events.
Events attack pattern got signing specifics that
actor electron iridium from
country. Let's say, it's Iran.
So you you can also put some
feeds into into the map
and you will get events events daily, and there
is lots of contribution and Miss. I really
enjoy using this.
But sadly since it's open source, meaning you
don't have a direct who can
like help you. If you have some issues. It's not
like a license tool. So it's like on your own
thing or you need to like highlight any
issues you have on GitHub and
some someone will help you.
So we can type. Let's say I don't know
dark web.
That might give you some events.
Based on the fields you have it can be limited.
because it's not a lot of fields
you have a limited field as much as you will get
so here we have fields from awesome or
a specific classifier type and
you can add and check. So here we
have something related to dark web. We have awesome aloe vera
and somewhere on sale on the dark web for only 40 dollars. So
basically I did filter based on dark web and it's
coming from the Olsen and these kind
of stuff but it's basically a
string research a text research.
So, so he also
we have the freon somewhere available on the dark web.
So it's really amazing to use MSP.
And you can integrate your own fields and you will have events
based on your feeds.
And you can create alerts.
and it will be the same as using recorded
future or
Casper sky
or crowdstrike, but keep in mind it's a
bit Limited.
okay, having Fields as much as decoded
future and the big tools the big platform
is but
the at all
So thank you and I will see you in the
next video where we will discuss Telegram.