securi.tylabs

Search This Blog

Blog refresh

on March 12, 2012

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Restarting this blog, we'll see what it looks like when we get there.

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Comments

Bro+MISP = Dovehawk Bro Module

Bro is a open source intrusion detection and discovery system. It can detect and log unusual activity, DNS queries and connections which can then be used for threat hunting on your network. MISP is an open source threat intelligence platform. It can store indicators, signatures, TTPs, analysis, attribution, and links to external reports on groups of information called Events. Bro+MISP Bro has some powerful APT hunting features built-in. The Intelligence Framework allows indicators to be tasked such as domains, IPs, file hashes (including SSL certificate hashes), and email addresses. This is where Dovehawk is a powerful tool to link your MISP directly to Bro. We've seen other Bro tools download and import a static file of indicators, but Dovehawk is the first to directly connect to MISP and task indicators at a regular timed interval and expire older indicators as they are deleted from MISP. Bro also has a signature framework for writing more advanced signatures which a

Behind the scenes - work in progress

Started working combining malware related relationships between samples, C2 infrastructure, and other indicators from a variety of sources of phishing document malware.

Powered by Blogger

Blog refresh

Comments

Post a Comment