Threat hunting with Netlas.io

Utilizing Netlas, a threat hunter can quickly identify IOCs (Indicators of compromise) of a specific malicious software, search for other instances of such software using IOCs as a search patterns, and promptly stop interaction with malicious infrastructure.

An example of IOCs and search query for open-source phishing framework is given in another case concerning IP reputation scoring. Another great example is the search for malicious servers.

Search by SSL certificates is often the most effective. Since certificates are not issued for each instance separately, their match indicates the use of the same software. Verification can be done based on JARM fingerprint for TLS and hashes for SSL. Using this approach, you can find, for example, Metasploit servers or or Cobalt Strike software. In addition to hashes and fingerprints, the search can be carried out using fields such as subject, issuer, and so on.

All the features mentioned above are available for search on Netlas. By identifying several IOCs and assessing the significance of each, the researcher can create a search query that will identify C&C servers using Netlas.

Similarly, services used for penetration testing, frameworks for emulation or execution of attacks, phishing attack frameworks, sites infected with crypto-miners, and much more can be found.