Category: Threat Intelligence

Feeding Analysis Information Leak (AIL) Framework

April 24, 2022May 13, 2022 A.McHugh No Comments

This is post 1 of 1 in the series “Analysis Information Leak (AIL) Framework”

I have been playing with CIRCL’s AIL Framework recently (which I will be writing about in another blog post), but I have had an interest in monitoring Telegram channels for Threat Intelligence and Data Breach indicators.

AIL has a very capable framework to detect indicators within processed information using a suite of very comprehensive Yara rules – but unless you want to copy and paste Telegram messages into AIL all day, some level of automation is required.

There is where the feeders come into play!

AIL Framework

An Introduction to Threat Intelligence

April 16, 2022April 16, 2022 A.McHugh No Comments

This is post 1 of 1 in the series “Building a Threat Intelligence Program”

You will have seen the advertisements as you’re browsing the Internet and will have seen the vendors at various conferences and trade shows spruiking Threat Intelligence as the way to detect the bad guys in your environment, or their product/service delivering highly enriched intelligence relevant to your organisation. But what is Threat Intelligence really? And just how well refined does it need to be?

Threat Intelligence

Deploying MISP on DigitalOcean or Vultr Cloud Hosting

July 31, 2021April 16, 2022 A.McHugh No Comments

I have found myself deploying MISP on very small instances lately, mostly to function as a clearinghouse for intelligence I have been generating. So it begs the question – Does MISP run in DigitalOcean or Vultr hosting?

Frameworks

Using the workflow taxonomy in MISP

May 23, 2021 A.McHugh No Comments

In the context of MISP, intelligence handling usually requires a set of stages for that information to be handled effectively. This can be addressed procedurally through a workflow.

Understanding how a taxonomy may be implemented in MISP to assist this process is handy.

MISP - Open Source Threat Intelligence Platform

Using the Estimative Language Taxonomy in MISP

May 11, 2021 A.McHugh No Comments

This is post 3 of 3 in the series “Implementing and utilising MISP Taxonomies”

Using the Course of Action Taxonomies in MISP
Using the Data Classification Taxonomies in MISP
Using the Estimative Language Taxonomy in MISP

According to the MISP taxonomies listing for Estimative Language, this taxonomy is used to descrie the quality and credibility of the underlying information sources, data, and methodologies as described under the Intelligence Community Directive 203 (ICD 203) and JP 2-0. In this article I will describe how these tags may be applied by either an intelligence originator, or when the information is polled from a known credible source to convey likelihood.

MISP - Open Source Threat Intelligence Platform

Using the Data Classification Taxonomies in MISP

May 11, 2021 A.McHugh No Comments

This is post 2 of 3 in the series “Implementing and utilising MISP Taxonomies”

Using the Course of Action Taxonomies in MISP
Using the Data Classification Taxonomies in MISP
Using the Estimative Language Taxonomy in MISP

Data classification is broadly defined as the process of organising data by relevant categories so that it may be used and protected more efficiently. On a basic level, the classification process makes data easier to locate and retrieve.

In this article, I will be discussing the usage of the data-classification taxonomy for MISP events and attributes within those events. The intent of this taxonomy being categorising the value of data to provide some additional context to the information or asset being affected.

MISP - Open Source Threat Intelligence Platform

Using the Course of Action Taxonomies in MISP

May 10, 2021 A.McHugh No Comments

This is post 1 of 3 in the series “Implementing and utilising MISP Taxonomies”

Using the Course of Action Taxonomies in MISP
Using the Data Classification Taxonomies in MISP
Using the Estimative Language Taxonomy in MISP

One of the great aspects of MISP, is the use of tags to give an indication of what needs to be done with an indicator within an event. Whole events may be assigned tags, but in this article I am going to talk to marking specific indicators with a Course of Action which implies a response when / if that indicator as been encountered.

MISP - Open Source Threat Intelligence Platform

Building Structured Threat Intelligence (STIX) from FBI notices

April 27, 2021 A.McHugh No Comments

Intelligence is pretty much everywhere in unstructured formats, and this can be in informal blog posts, tweets, and even within FBI or US Treasury documents. In this article, I am going to describe how to build a transferrable STIX object from the FBI’s Most Wanted website.

MISP - Open Source Threat Intelligence Platform

Using MISP in an air-gapped environment

March 20, 2021 A.McHugh No Comments

MISP works really well in an internet connected environment in gathering and creating correlations. However, in air-gapped environments the ability to query MISP for indicators is still incredibly useful, except that an air-gapped environment doesn’t ordinarilly have an Internet connection.

In this article I describe how MISP may be used in an Internet denied environment by leveraging off an existing Internet-connected instance.

Design, MISP - Open Source Threat Intelligence Platform

Using MISP in a TraceLabs Missing Persons engagement

February 14, 2021 A.McHugh No Comments

MISP is certainly intended to be used like this, however, with some creativity and some technical effort, the MISP Threat Intelligence Platform could be utilized as a missing person’s intelligence database.

In this post, I will discuss a methodology in using MISP as the Intelligence Platform, and more traditional applications such as Maltego (and some custom transforms) to collect, enrich, and manage your intelligence.

Blog, MISP - Open Source Threat Intelligence Platform