Using OTX to gather Threat Intelligence
Last updated
Was this helpful?
Last updated
Was this helpful?
Pulse Overview
Pulses can consist of a description, tags, indicator types (file hash, Yara, IP, domain, etc.), and threat infrastructure (country of origin). OTX uses pulses as their indicators. A majority of pulses are community-created and maintained. You need to keep this in mind when using pulses for threat intelligence as not all pulses are legit or may contain inaccurate information. Always verify and analyze the indicators used before using them for CTI.
Breaking Down a Pulse
First, we need to understand how to analyze and gather information from a pulse in order to understand how to use OTX's many categories, ways of obtaining threat intelligence, and indicators.
As an example, we will be looking at the Xanthe - Docker aware miner pulse released from the official AlienVault account. You can find it .
Pulses consist of three main sections: Pulse Description, Indicator Overview, Indicators. We will break down these sections further and identify each component of them.
Pulse Description
The Pulse Description consists of the description itself, references, tags, malware families, and ATT&CK IDs. The three most important parts are the reference section, the description itself, and the ATT&CK IDs. The references can be used to verify the pulse and get further background information on the pulse/indicators. The description can give you a brief overview of what the pulse is for and how it was gathered which can be useful when quickly looking for pulses to use. The ATT&CK IDs can be used to quickly identify what TTPs are being used by the pulse and familiarize yourself with them. For more information about ATT&CK check out Heavenraiza's .
Type - The type of indicator (URL, File Hash, IP, Domain, etc.)
Indicator - The indicator itself
Added - Date added, pulses can be updated this can be useful to track the pulses history
Active - Shows, whether the indicator is still seen in the wild and active, can be useful when selecting pulses to use.
Related Pulses - Shows pulses that share the same indicator, can be useful to cross-check indicators.
Extra Information (Advanced) - These are the advanced options including Dynamic Analysis, Network Activity, and YARA rules.
The Advanced section of indicators can contain the most information and allow you to get a better understanding of what you are dealing with. Not all pulses or indicators will contain any advanced information but it can be very useful when available. Below is an example of a YARA detection and dynamic analysis of a binary from a file hash.
If you want to find pulses only for a specific malware strain you can look for pulses based on malware. This allows you to very quickly find IOCs and rules for a specific strain of malware.
Note: Malware authors are constantly working to change and mitigate indicators and signatures, be aware that indicators change when looking for specific malware indicators.
The menu for malware is by far the most detailed including features of the malware, related pulses, process visualization, and file samples if available.
OTX will also visualize the processes the malware is running. Overall the malware categories will allow you to quickly identify multiple aspects of malware including processes, features and pulses.
Finding Pulses based on Adversaries
Note: Each vendor has its own naming scheme for APTs take note of this when looking for pulses by adversary.
The adversary menu will give you a short description of the group as well as pulses related to that group.
Finding Pulses based on Industry
A common vector for adversaries to focus on is the industry of their target, for example, finance, education, aerospace, etc. Adversaries will sometimes target corporations in one specific industry. An example of this is the Ryuk malware being distributed by "one" group targeting financial corporations
Indicator Overview The Indicator Overview will give you a very brief statistical representation of the indicators within the pulse as well as threat infrastructure. The indicator overview can be useful when looking for a very specific IOC like a file hash or YARA rule, etc. From here we can see that the pulse has six different types of indicators as well as four different countries that the pulse is originating from. Note: A majority of pulses do not have threat infrastructure however it can be useful when analyzing a pulse for CTI. Indicators Indicators are probably the most important section of the entire pulse. It contains all of the indicators and information about them. There is a lot of information to break down for each pulse. Look below for more information about each column of the indicators.
Finding Pulses based on Malware
To get started with identifying pulses by adversaries you need to have a foundational knowledge of adversaries and their operations. To get an introduction to adversarial operations check out the . You can identify pulses based on the adversary group.
When opening the industry menu you will see a general description as well as any pulses tag / related to the industry.
