You're reading from Effective Threat Investigation for SOC Analysts

Product typeBook

Published inAug 2023

PublisherPackt

ISBN-139781837634781

Edition1st Edition

Concepts

Cybersecurity

Author (1)

Mostafa Yahia

Threat Intelligence in a SOC Analyst’s Day

Threat intelligence platforms play a crucial role for cybersecurity analysts to investigate aspects of cyber threats. As a Security Operations Center (SOC) analyst, you should leverage and take advantage of the different threat intelligence platforms to investigate cyber threat artifacts such as IPs, domains, hashes, and so on.

The objective of this chapter is to learn about the meaning of threat intelligence, the role of threat intelligence in SOCs, and how to use the VirusTotal, IBM X-Force, AbuseIPDB, and Google platforms to investigate cyber threat artifacts.

In this chapter, we’re going to cover the following main topics:

Introduction to threat intelligence
Investigating threats using VirusTotal
Investigating threats using IBM X-Force
Investigating threats using AbuseIPDB
Investigating threats using Google

Let’s get started!

Introduction to threat intelligence

In cyber security, threat intelligence represents sharing contextual threat information on attacks and threat actors across defense environments. Also, Gartner defines threat intelligence as the following: “Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.”

The information shared in threat intelligence, which is also known as threat intelligence feeds, is divided into three levels:

Strategic
Operational
Tactical

Strategic level

The strategic threat intelligence level is information about the organization’s threat landscape. This type of information usually does not contain technical information and is shared with company managers and decision-makers to help them to...

Investigating threats using VirusTotal

VirusTotal is a Threat Intelligence Platform (TIP) that allows security analysts to analyze suspicious files, hashes, domains, IPs, and URLs to detect and investigate malware and other cyber threats. Moreover, VirusTotal is known for its robust automation capabilities, which allow for the automatic sharing of this intelligence with the broader security community. See Figure 14.1:

Figure 14.1 – The VirusTotal platform main web page

The VirusTotal scans submitted artifacts, such as hashes, domains, URLs, and IPs, against more than 88 security solution signatures and intelligence databases. As a SOC analyst, you should use the VirusTotal platform to investigate the following:

Suspicious files
Suspicious domains and URLs
Suspicious outbound IPs

Investigating suspicious files

VirusTotal allows cyber security analysts to analyze suspicious files either by uploading the file or searching...

Investigating threats using IBM X-Force Exchange

IBM X-Force Exchange is a threat intelligence sharing platform that SOC analysts can use to investigate IPs, domains, URLs, and hashes. By accessing the IBM X-Force website (https://exchange.xforce.ibmcloud.com/), analysts can find the search form, which allows them to enter the artifacts such as IPs, domains, URLs, and hashes. See Figure 14.15:

Figure 14.15 – The IBM X-Force website

As you can see, the main web page includes the most trending threats in the form of hashtags and dashboards; most of them are analyzed and collected by the X-Force researcher teams.

Investigating suspicious domains

As we mentioned, the IBM X-Force platform allows you to investigate suspicious domains and URLs. Let us start investigating the antibasic[.]ga domain by entering it into the search form. See Figure 14.15:

Figure 14.16 – Investigating the antibasic[.]ga domain

As you...

Investigating suspicious inbound IPs using AbuseIPDB

AbuseIPDB is a platform that allows cyber defenders to report any abuse of IPs toward their network’s IPs, specifically targeting inbound IPs, including port-scanning IPs, vulnerability-scanning IPs, and malicious SMTP servers.

By accessing the AbuseIPDB website (https://www.abuseipdb.com/), you will be able to either report IP addresses that engage in hacking attempts or any other malicious behavior, or check the report history of any IP address to see whether there have been any other reports of malicious activities from the same IP. See Figure 14.20:

Figure 14.20 – The AbuseIPDB main webpage

Assuming that during your monitoring activities, you find several brute-forcing attempts from the 223.113.73.226 IP address. To investigate this IP’s reputation, you can enter it into the IP Check form in AbuseIPDB. See Figure 14.21:

Figure 14.21 – Investigating...

Investigating threats using Google

While Google is not a TIP, it is helpful for investigating threats artifacts such as domain names, filenames, and user agents. By enclosing the suspicious value within double quotes ("") during a search, you may get interesting search results. For example, during the investigation, you find a suspicious user agent of a web communication traffic, and after searching for it on Google, you find a threat report saying that the user agent string was used by a threat actor for its C&C communications. Similarly, you may find suspicious web communications with a web domain, which you want to investigate by using Google, and after searching, you find it doesn’t have a GUI and exists in one of the threat intelligence reports, indicating that the domain is the C&C server of a specific threat actor. See Figure 14.22:

Figure 14.22 – Investigating a suspicious domain using Google

As you can see in the...

Summary

In this chapter, we extensively covered the meaning and significance of threat intelligence in SOCs. We have also delved into the details of how to use various platforms such as VirusTotal, IBM X-Force, AbuseIPDB, and Google to investigate various cyber threat artifacts. To summarize, the following table highlights the preferred platforms to use to investigate different types of threat artifacts:

The rest of the chapter is locked

You have been reading a chapter from

Effective Threat Investigation for SOC Analysts

Published in: Aug 2023Publisher: PacktISBN-13: 9781837634781

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $15.99/month. Cancel anytime

Author (1)

Mostafa Yahia

Mostafa Yahia is a skilled and motivated threat investigator and hunter with a wealth of experience investigating and hunting down various cyber threats. He is a proven leader in building and leading cybersecurity-managed services such as SOC and threat-hunting services. Mostafa holds a bachelor's degree in computer science, which he earned in 2016, and has furthered his education by earning multiple industry-recognized certifications, including GCFA, GCIH, CCNA, and IBM QRadar. In addition to his professional work, Mostafa also shares his knowledge through free courses and lessons on his YouTube channel. Currently, he serves as the senior lead for cyber defence services in an MSSP company, overseeing SOC, TH, DFIR, and CA services.
Read more about Mostafa Yahia

Personalised recommendations for you

Based on your interests and search pattern

Attacking and Exploiting Modern Web Applications

Attacking and Exploiting Modern Web Attacks will help you understand how to identify attack surfaces and detect vulnerabilities. This book takes a hands-on approach to implementation and associated methodologies and equips you with the knowledge and skills needed to effectively combat web attacks.

BookAug 2023338 pages

Automotive Cybersecurity Engineering Handbook

This Automotive Cybersecurity Engineering Handbook untangles the complexities of building secure automotive products and helps you to comply with cybersecurity standards. It provides practical tools, tips, and techniques coupled with real-world examples to enable you to create cyber-resilient automotive products with ease.

BookOct 2023392 pages

Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide

This book will help you to design, develop, and operate security controls on Google Cloud as well as discover best practices for relevant security domains, including identity and access management, network, and data.

BookAug 2023496 pages

Cloud Penetration Testing for Red Teamers

The advent of cloud networks and the AWS, Azure, and GCP platforms has revolutionized how companies of all sizes in all industries do business online. This book will help you meet the emerging demand for pentesting as it guides you through the tools, techniques, and security measures used by pentesters and red teamers in the 2020s and beyond.

BookNov 2023298 pages

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

ISACA Certified in Risk and Information Systems Control (CRISC®) Certification Guide is an enterprise IT risk management professional’s dream. With its in-depth approach and various self-assessment exercises, this book arms you with knowledge of every single aspect of the certification, and is a fantastic career companion after you’re certified.

BookSep 2023316 pages5

Burp Suite Cookbook

Burp Suite is an immensely powerful and popular tool for web application security testing. This book provides a collection of recipes that address vulnerabilities in web applications and APIs. It offers guidance on how to configure Burp Suite, make the most of its tools, and explore into its extensions.

BookOct 2023450 pages

Building and Automating Penetration Testing Labs in the Cloud

This hands-on guide will help you design and build a variety of penetration testing labs that mimic modern cloud environments running on AWS, Azure, and GCP. In addition to these, you will explore a number of practical strategies on how to manage the complexity, cost, and security risks involved when setting up vulnerable cloud lab environments.

BookOct 2023562 pages

Ethical Hacking Workshop

As cyber-attacks grow and APT groups advance their skillset, you need to be able to protect your enterprise against cyber-attacks. In order to limit your attack surface, you need to ensure that you leverage the same skills and tools that an adversary may use to hack your environment and discover the security gaps. This book will teach you how to think like a hacker, use state-of-the-art hacking tools, and protect yourself and your organizaiton.

BookOct 2023220 pages

Windows Forensics Analyst Field Guide

This book contains step-by-step processes to guide you in any investigation related to Windows OS. You’ll find out how to acquire evidence using multiple tools as well as examine and analyze the collected artifacts, while discovering multiple techniques used in real-world forensic incidents.

BookOct 2023318 pages

Implementing DevSecOps Practices

This book is a comprehensive, hands-on guide for individuals new to DevSecOps who want to implement DevSecOps practices successfully and efficiently. With its help, you’ll be able to shift security toward the left, enabling you to merge security into coding in no time.

BookDec 2023258 pages

Artifact type	VirusTotal	X-Force	AbuseIPDB	Google
Web domain	✔	✔		✔
Outbound IP	✔	✔
File hash	✔	✔		...