Skip to content

Commit 788ae90

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#13198 from VirusTotal/feat-threat-hunting-google-threat-intelligence
Feat: Threat Hunting Google Threat Intelligence
2 parents 3c673b9 + 20ea63b commit 788ae90

File tree

13 files changed

+1390
-6
lines changed

13 files changed

+1390
-6
lines changed

‎Solutions/Google Threat Intelligence/Analytic Rules/ThreatHunting/ThreatHuntDomain.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
id: "d9e1646c-dc17-4150-ac85-581f5c9cb41f"
2+
name: Google Threat Intelligence - Threat Hunting Domain
3+
description: |
4+
'Google Threat Intelligence domain correlation.'
5+
severity: Medium
6+
requiredDataConnectors:
7+
- connectorId: ThreatIntelligence
8+
dataTypes:
9+
- ThreatIntelIndicators
10+
queryFrequency: 30m
11+
queryPeriod: 1d
12+
triggerOperator: gt
13+
triggerThreshold: 0
14+
tactics:
15+
- CommandAndControl
16+
relevantTechniques:
17+
- T1071
18+
incidentConfiguration:
19+
createIncident: true
20+
groupingConfiguration:
21+
enabled: true
22+
reopenClosedIncident: false
23+
lookbackDuration: 1h
24+
matchingMethod: AllEntities
25+
eventGroupingSettings:
26+
aggregationKind: AlertPerResult
27+
alertDetailsOverride:
28+
alertDisplayNameFormat: 'Google Threat Intelligence Match'
29+
alertDescriptionFormat: 'Correlation found from the {{Type}} table.'
30+
query: |
31+
let ioc_lookBack = 1d;
32+
_Im_Dns
33+
| where isnotempty(DnsQuery)
34+
| extend lowerDomain=tolower(DnsQuery)
35+
| join kind=inner (
36+
ThreatIntelIndicators
37+
| where ObservableKey == 'domain-name:value'
38+
| where isnotempty(ObservableValue)
39+
| where SourceSystem == "Google Threat Intelligence"
40+
| where TimeGenerated >= ago(ioc_lookBack)
41+
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
42+
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
43+
| extend lowerDomain=tolower(ObservableValue)
44+
) on lowerDomain
45+
| project Domain=ObservableValue, Description=Data.description, Type, TimeGenerated
46+
entityMappings:
47+
- entityType: DNS
48+
fieldMappings:
49+
- identifier: DomainName
50+
columnName: Domain
51+
version: 1.0.0
52+
kind: Scheduled

‎Solutions/Google Threat Intelligence/Analytic Rules/ThreatHunting/ThreatHuntHash.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
id: "8f9cd0e5-b4ab-4821-95e2-1082fcd784c7"
2+
name: Google Threat Intelligence - Threat Hunting Hash
3+
description: |
4+
'Google Threat Intelligence hash correlation.'
5+
severity: Medium
6+
requiredDataConnectors:
7+
- connectorId: ThreatIntelligence
8+
dataTypes:
9+
- ThreatIntelIndicators
10+
queryFrequency: 30m
11+
queryPeriod: 1d
12+
triggerOperator: gt
13+
triggerThreshold: 0
14+
tactics:
15+
- Execution
16+
relevantTechniques:
17+
- T1059
18+
incidentConfiguration:
19+
createIncident: true
20+
groupingConfiguration:
21+
enabled: true
22+
reopenClosedIncident: false
23+
lookbackDuration: 1h
24+
matchingMethod: AllEntities
25+
eventGroupingSettings:
26+
aggregationKind: AlertPerResult
27+
alertDetailsOverride:
28+
alertDisplayNameFormat: 'Google Threat Intelligence Match'
29+
alertDescriptionFormat: 'Correlation found from the {{Type}} table.'
30+
query: |
31+
let ioc_lookBack = 1d;
32+
_Im_FileEvent
33+
| where isnotempty(Hash)
34+
| extend lowerHash=tolower(Hash)
35+
| join kind=inner (
36+
ThreatIntelIndicators
37+
| where ObservableKey contains 'file:hashes'
38+
| where isnotempty(ObservableValue)
39+
| where SourceSystem == "Google Threat Intelligence"
40+
| where TimeGenerated >= ago(ioc_lookBack)
41+
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
42+
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
43+
| extend lowerHash=tolower(ObservableValue)
44+
) on lowerHash
45+
| project Hash=ObservableValue, HashType=extract("file:hashes.('[^']*')", 1, ObservableKey), Description=Data.description, Type, TimeGenerated
46+
entityMappings:
47+
- entityType: FileHash
48+
fieldMappings:
49+
- identifier: Value
50+
columnName: Hash
51+
- identifier: Algorithm
52+
columnName: HashType
53+
version: 1.0.0
54+
kind: Scheduled

‎Solutions/Google Threat Intelligence/Analytic Rules/ThreatHunting/ThreatHuntIp.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
id: "7edb2abb-7ef7-4685-92eb-a628703ccf9f"
2+
name: Google Threat Intelligence - Threat Hunting IP
3+
description: |
4+
'Google Threat Intelligence IP correlation.'
5+
severity: Medium
6+
requiredDataConnectors:
7+
- connectorId: ThreatIntelligence
8+
dataTypes:
9+
- ThreatIntelIndicators
10+
queryFrequency: 30m
11+
queryPeriod: 1d
12+
triggerOperator: gt
13+
triggerThreshold: 0
14+
tactics:
15+
- CommandAndControl
16+
relevantTechniques:
17+
- T1071
18+
incidentConfiguration:
19+
createIncident: true
20+
groupingConfiguration:
21+
enabled: true
22+
reopenClosedIncident: false
23+
lookbackDuration: 1h
24+
matchingMethod: AllEntities
25+
eventGroupingSettings:
26+
aggregationKind: AlertPerResult
27+
alertDetailsOverride:
28+
alertDisplayNameFormat: 'Google Threat Intelligence Match'
29+
alertDescriptionFormat: 'Correlation found from the {{Type}} table.'
30+
query: |
31+
let ioc_lookBack = 1d;
32+
_Im_NetworkSession
33+
| where isnotempty(DstIpAddr)
34+
| join kind=inner (
35+
ThreatIntelIndicators
36+
| where ObservableKey == 'ipv4-addr:value'
37+
| where isnotempty(ObservableValue)
38+
| where SourceSystem == "Google Threat Intelligence"
39+
| where TimeGenerated >= ago(ioc_lookBack)
40+
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
41+
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
42+
) on $left.DstIpAddr == $right.ObservableValue
43+
| project NetworkIP=ObservableValue, Description=Data.description, Type, TimeGenerated
44+
entityMappings:
45+
- entityType: IP
46+
fieldMappings:
47+
- identifier: Address
48+
columnName: NetworkIP
49+
version: 1.0.0
50+
kind: Scheduled

‎Solutions/Google Threat Intelligence/Analytic Rules/ThreatHunting/ThreatHuntUrl.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
id: "89290690-54c4-4196-91c5-d32b1df5d873"
2+
name: Google Threat Intelligence - Threat Hunting Url
3+
description: |
4+
'Google Threat Intelligence Url correlation.'
5+
severity: Medium
6+
requiredDataConnectors:
7+
- connectorId: ThreatIntelligence
8+
dataTypes:
9+
- ThreatIntelIndicators
10+
queryFrequency: 30m
11+
queryPeriod: 1d
12+
triggerOperator: gt
13+
triggerThreshold: 0
14+
tactics:
15+
- InitialAccess
16+
relevantTechniques:
17+
- T1566
18+
incidentConfiguration:
19+
createIncident: true
20+
groupingConfiguration:
21+
enabled: true
22+
reopenClosedIncident: false
23+
lookbackDuration: 1h
24+
matchingMethod: AllEntities
25+
eventGroupingSettings:
26+
aggregationKind: AlertPerResult
27+
alertDetailsOverride:
28+
alertDisplayNameFormat: 'Google Threat Intelligence Match'
29+
alertDescriptionFormat: 'Correlation found from the {{Type}} table.'
30+
query: |
31+
let ioc_lookBack = 1d;
32+
_Im_WebSession
33+
| where isnotempty(Url)
34+
| extend lowerUrl=tolower(Url)
35+
| join kind=inner (
36+
ThreatIntelIndicators
37+
| where ObservableKey == 'url:value'
38+
| where isnotempty(ObservableValue)
39+
| where SourceSystem == "Google Threat Intelligence"
40+
| where TimeGenerated >= ago(ioc_lookBack)
41+
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
42+
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
43+
| extend lowerUrl=tolower(ObservableValue)
44+
) on lowerUrl
45+
| project Url=ObservableValue, Description=Data.description, Type, TimeGenerated
46+
entityMappings:
47+
- entityType: URL
48+
fieldMappings:
49+
- identifier: Url
50+
columnName: Url
51+
version: 1.0.0
52+
kind: Scheduled

‎Solutions/Google Threat Intelligence/Data/Solution_GoogleThreatIntelligence.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,18 @@
55
"Description": "This Google Threat Intelligence Solution contains Playbooks that can help enrich incident information with threat information and intelligence for IPs, file hashes and URLs from Google Threat Intelligence. Enriched information can help drive focused investigations in Security Operations.",
66
"Data Connectors": [],
77
"Parsers": [],
8-
"Hunting Queries": [],
9-
"Analytic Rules": [],
8+
"Hunting Queries": [
9+
"Hunting Queries/ThreatHuntHash.yaml",
10+
"Hunting Queries/ThreatHuntIp.yaml",
11+
"Hunting Queries/ThreatHuntDomain.yaml",
12+
"Hunting Queries/ThreatHuntUrl.yaml"
13+
],
14+
"Analytic Rules": [
15+
"Analytic Rules/ThreatHunting/ThreatHuntHash.yaml",
16+
"Analytic Rules/ThreatHunting/ThreatHuntIp.yaml",
17+
"Analytic Rules/ThreatHunting/ThreatHuntDomain.yaml",
18+
"Analytic Rules/ThreatHunting/ThreatHuntUrl.yaml"
19+
],
1020
"Workbooks": [],
1121
"Playbooks": [
1222
"Playbooks/CustomConnector/GTICustomConnector/azuredeploy.json",

‎Solutions/Google Threat Intelligence/Hunting Queries/ThreatHuntDomain.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: "34288e97-5194-4f2e-abf2-c2783189f6ae"
2+
name: Google Threat Intelligence - Threat Hunting Domain
3+
description: |
4+
'Google Threat Intelligence domain correlation.'
5+
severity: Medium
6+
requiredDataConnectors:
7+
- connectorId: ThreatIntelligence
8+
dataTypes:
9+
- ThreatIntelIndicators
10+
tags:
11+
- GoogleThreatIntelligence
12+
query: |
13+
_Im_Dns
14+
| where isnotempty(Domain)
15+
| join kind=inner (
16+
ThreatIntelIndicators
17+
| where ObservableKey == 'domain-name:value'
18+
| where isnotempty(ObservableValue)
19+
| where SourceSystem == "Google Threat Intelligence"
20+
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
21+
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
22+
) on $left.Domain == $right.ObservableValue
23+
| project Domain, DstIpAddr
24+
| extend IP_0_Address = DstIpAddr
25+
| extend DNS_0_DomainName = Domain
26+
entityMappings:
27+
- entityType: DNS
28+
fieldMappings:
29+
- identifier: DomainName
30+
columnName: Domain
31+
- entityType: IP
32+
fieldMappings:
33+
- identifier: Address
34+
columnName: DstIpAddr
35+
version: 1.0.0

‎Solutions/Google Threat Intelligence/Hunting Queries/ThreatHuntHash.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: "0051a0d9-684f-4317-abbd-c1e5c24b39cb"
2+
name: Google Threat Intelligence - Threat Hunting Hash
3+
description: |
4+
'Google Threat Intelligence hash correlation.'
5+
severity: Medium
6+
requiredDataConnectors:
7+
- connectorId: ThreatIntelligence
8+
dataTypes:
9+
- ThreatIntelIndicators
10+
tags:
11+
- GoogleThreatIntelligence
12+
query: |
13+
_Im_FileEvent
14+
| where isnotempty(Hash)
15+
| join kind=inner (
16+
ThreatIntelIndicators
17+
| where ObservableKey contains 'file:hashes'
18+
| where isnotempty(ObservableValue)
19+
| where SourceSystem == "Google Threat Intelligence"
20+
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
21+
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
22+
) on $left.Hash == $right.ObservableValue
23+
| project Hash, HashType
24+
| extend FileHash_0_Value = Hash
25+
| extend FileHash_0_Algorithm = HashType
26+
entityMappings:
27+
- entityType: FileHash
28+
fieldMappings:
29+
- identifier: Value
30+
columnName: Hash
31+
- entityType: FileHash
32+
fieldMappings:
33+
- identifier: Algorithm
34+
columnName: HashType
35+
version: 1.0.0

‎Solutions/Google Threat Intelligence/Hunting Queries/ThreatHuntIp.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: "faa83502-2763-49ae-9216-e576fa1fdccb"
2+
name: Google Threat Intelligence - Threat Hunting IP
3+
description: |
4+
'Google Threat Intelligence IP correlation.'
5+
severity: Medium
6+
requiredDataConnectors:
7+
- connectorId: ThreatIntelligence
8+
dataTypes:
9+
- ThreatIntelIndicators
10+
tags:
11+
- GoogleThreatIntelligence
12+
query: |
13+
_Im_NetworkSession
14+
| where isnotempty(DstIpAddr)
15+
| join kind= innerunique (
16+
ThreatIntelIndicators
17+
| where ObservableKey == 'ipv4-addr:value'
18+
| where isnotempty(ObservableValue)
19+
| where SourceSystem == "Google Threat Intelligence"
20+
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
21+
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
22+
) on $left.DstIpAddr == $right.ObservableValue
23+
| project DstIpAddr
24+
| extend IP_0_Address = DstIpAddr
25+
entityMappings:
26+
- entityType: IP
27+
fieldMappings:
28+
- identifier: Address
29+
columnName: DstIpAddr
30+
version: 1.0.0

‎Solutions/Google Threat Intelligence/Hunting Queries/ThreatHuntUrl.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: "a1705fa5-c904-4f1b-9e2d-a4ccb30377a2"
2+
name: Google Threat Intelligence - Threat Hunting Url
3+
description: |
4+
'Google Threat Intelligence Url correlation.'
5+
severity: Medium
6+
requiredDataConnectors:
7+
- connectorId: ThreatIntelligence
8+
dataTypes:
9+
- ThreatIntelIndicators
10+
tags:
11+
- GoogleThreatIntelligence
12+
query: |
13+
_Im_WebSession
14+
| where isnotempty(Url)
15+
| join kind=inner (
16+
ThreatIntelIndicators
17+
| where ObservableKey == 'url:value'
18+
| where isnotempty(ObservableValue)
19+
| where SourceSystem == "Google Threat Intelligence"
20+
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
21+
| where IsActive == true and (isnull(ValidUntil) or ValidUntil > now())
22+
) on $left.Url == $right.ObservableValue
23+
| project Url
24+
| extend URL_0_Url = Url
25+
entityMappings:
26+
- entityType: URL
27+
fieldMappings:
28+
- identifier: Url
29+
columnName: Url
30+
version: 1.0.0

‎Solutions/Google Threat Intelligence/Package/3.2.2.zip‎

3.78 KB
Binary file not shown.

0 commit comments

Comments
 (0)