Threat Intelligence - What are your experiences \ do you have recommendations ?

Hello @Andre Kurtz ,

we have tested at least two paid threat intelligence feeds and unfortunately I have to say that they are all very prone to throw false positives.

Especially with the modern internet architecture with highly flexible content delivery networks, cloud servers etc. an IP address which hosted a malware in the morning can be a legitimate amazon server in the evening. So those feeds are outdated very fast and thus will trigger false positives.

Often, the malware servers are also very short-lived because they consist of hacked wordpress instances that are taken offline with an abuse message to the web hosting provider.

In addition, each threat feed provider can only update the current information with a certain delay. This means that in some cases the firewall logs that contain information about a C2 connection were still "clean" according to the threat feed at the time the logs arrived in the SIEM.

From this follows that at the time of enrichment after log normalization no threat feed information is added to the logs. And since the volume of the firewall logs is usually very high, the alert rules that may use "process ti()" should not run on too high time ranges.

In summary, these threat feeds should be treated with caution. If you have enough manpower to process the amount of false positives, you can try it out.

Sorry for the delayed response Markus. Thought i would get notified when a response was made. Have to check my notification settings ;-)

we have tested at least two paid threat intelligence feeds and unfortunately I have to say that they are all very prone to throw false positives.

Especially with the modern internet architecture with highly flexible content delivery networks, cloud servers etc. an IP address which hosted a malware in the morning can be a legitimate amazon server in the evening. So those feeds are outdated very fast and thus will trigger false positives.

Often, the malware servers are also very short-lived because they consist of hacked wordpress instances that are taken offline with an abuse message to the web hosting provider.

Your statement basically concurrs with my own thougths and (limited) experiences about the issue. Was hoping i was wrong though.

In addition, each threat feed provider can only update the current information with a certain delay. This means that in some cases the firewall logs that contain information about a C2 connection were still "clean" according to the threat feed at the time the logs arrived in the SIEM.

That is why my idea was to use TI for a retrospective analysis of the logs, i.e. searching the logs of the last 7 days against the TI for any connection to a IoC (IP, URL, email address) that has been allowed because the AV patterns didn’t know the IoC at the time of the connection. We would then manually investigate this further.

However, the amount of false positives was just to much to handle. Thought a better TI feed would yield better results 😞 , hence my question about the expiriences other community members had with TI.

Hi Andre,

the only good thing in this is that I now know that we are not the only ones who have faced this problem 😃

We even came to the sobering conclusion that the only reliable way to detect a security incident with the help of a SIEM without large amounts of false positives is to integrate the client/workstation systems.
For windows with sysmon and for linux with auditd. You need to know what happens on the systems where a human being sits in front of it and is controlling the mouse...

Everything else (firewalls, IDS, EDR systems, etc.) may be helpful in the event of an incident response, but is largely useless for detection or the SIEM only acts as a “flow heater” (alerts an alert of another system).

Hi Markus,

totally agree, we basically came to the same conclusion 😀. Especially as most attacks nowadays use email as initial attack vector to gain a foothold into the victims network. However, we didn’t actually follow that road due to the lack of man power and the licencing costs.

Hi Markus

Would you be willing to disclose what commands or configuration you ar using with both Sysmon and Auditd?
Are you using this as a supplement to WinEvtx and AV endpoint logs?

/Mads