ANY.RUN’s Enhanced Threat Intelligence Feeds With Unique IOC for SOC/DFIR Teams

ANY.RUN’s Threat Intelligence (TI) Feeds have established themselves as a valuable resource for cybersecurity professionals seeking fresh and unique indicators of compromise (IOCs).

This continuously updated stream of threat intelligence leverages data from over 500,000 researchers and security professionals worldwide, helping SOC teams to detect and mitigate emerging threats more efficiently.

The platform’s distinctive methods for extracting and enriching IOCs set it apart in the crowded threat intelligence marketplace.

How ANY.RUN Sources Its Threat Intelligence

ANY.RUN’s threat intelligence platform derives its data from an extensive community of cybersecurity professionals who regularly upload and analyze real-world malware and phishing samples.

This crowdsourced approach ensures that the platform receives a constant influx of contemporary threat samples from around the globe.

The public submissions repository serves as a goldmine of information, capturing the latest malicious activities and emerging threat patterns. This community-driven model enables ANY.RUN to maintain an up-to-date database of threats that reflects the current threat landscape rather than relying solely on historical data.

Comprehensive IOC Coverage

The TI Feeds from ANY.RUN provide various types of indicators with reliability scores ranging from 50 (suspicious) to 100 (highly reliable). These indicators include:

• IP addresses associated with command-and-control (C2) servers or phishing campaigns
• Malicious domains that often connect multiple IPs or malware instances within a single campaign
• URLs serving as gateways for malware distribution or phishing operations

Each indicator comes with enriched context, including threat scores, threat names, types, detection timestamps, and related file hashes. This contextual information helps security teams prioritize alerts and respond more effectively to potential threats.

Unique Methods for IOC Extraction

What distinguishes ANY.RUN’s approach is its methodology for IOC extraction, which produces indicators that may not be available through other intelligence services. The platform employs two primary techniques to generate unique IOCs.

Malware Configuration Extraction

The first method involves automatic extraction of configurations from malware samples. Malware configurations typically contain hardcoded IOCs such as C2 server addresses, encryption keys, and attack parameters.

Take a look at this sandbox session.

ANY.RUN’s Interactive Sandbox can automatically parse these configurations for dozens of malware families, extracting valuable indicators directly from the malware’s operational code. This capability provides insight into the infrastructure that attackers are actively using, rather than just historical data.

For example, when analyzing an AsyncRAT sample in the sandbox, the MalConf window reveals the extracted configuration, including the malicious IP address used for C2 communications. This indicator is then automatically fed into the TI Feeds system and made available to clients.

Network Traffic Analysis via Suricata IDS

The second method leverages Suricata Intrusion Detection System (IDS) rules to identify patterns in network traffic. This approach can recognize threats even when attackers change their infrastructure, as it focuses on behavioral patterns rather than static indicators.

Check out this report, which shows analysis of a FormBook sample.

ANY.RUN’s integration of Suricata IDS for traffic analysis allows it to extract fresh network indicators from the newest samples of evolving malware. When a Suricata rule is triggered during analysis, the system can identify malicious domains or IP addresses being contacted by the malware.

In one example, analysis of a FormBook sample triggered a Suricata rule that detected connection to an attacker-controlled domain. This domain was then immediately added to the TI Feeds, enhancing clients’ defensive capabilities against this specific threat.

Integration Options for Organizations

ANY.RUN offers its Threat Intelligence Feeds in industry-standard formats, including STIX and MISP, making integration with existing security infrastructure straightforward for most organizations.

For those interested in testing the service, ANY.RUN provides free demo feed samples in both formats. Additionally, the company maintains a dedicated MISP instance that organizations can synchronize with their own servers or connect to their security solutions.

These integration options allow security teams to:

• Expand and accelerate threat hunting with up-to-date indicators
• Enhance alert triage and prioritize urgent issues
• Improve incident response through better threat understanding
• Proactively defend against new and evolving threats

You can test ANY.RUN’s Threat Intelligence Feeds in STIX and MISP formats by getting a free demo sample here. 

The Growing Importance of Fresh Threat Intelligence

In today’s rapidly evolving threat landscape, the freshness and uniqueness of threat intelligence are crucial factors for effective cybersecurity. Traditional methods of collecting IOCs often struggle to keep pace with sophisticated attackers who regularly change their infrastructure and tactics.

ANY.RUN’s approach to extracting IOCs directly from malware configurations and network traffic provides organizations with indicators that might not be detected through other means. This gives security teams an edge in identifying and mitigating threats before they can cause significant damage.

As cyber threats continue to evolve in complexity and scale, platforms that can provide unique insights into attacker infrastructure and methodologies will likely play an increasingly important role in organizational security strategies.

ANY.RUN’s Threat Intelligence Feeds represent a significant approach to IOC collection and distribution, leveraging both community contributions and advanced technical extraction methods.

By automatically harvesting indicators from malware configurations and network traffic analysis, the platform provides security teams with unique data points that can enhance threat detection capabilities.

For organizations looking to strengthen their security posture against emerging threats, the ability to access fresh, unique indicators of compromise could prove invaluable in the ongoing battle against malicious actors.

As threat intelligence continues to grow in importance for cybersecurity strategies, services that can provide distinctive and timely insights will likely see increased adoption across the industry.

Get a 14-day free trial of ANY.RUN’s Threat Intelligence service →

The post ANY.RUN’s Enhanced Threat Intelligence Feeds With Unique IOC for SOC/DFIR Teams appeared first on Cyber Security News.