<h2>Deliver COVID-19 Intelligence to Your Security Controls</h2><p>Malicious actors continue to leverage the global Coronavirus (COVID-19) pandemic to register phishing and malware domains to lure unsuspecting users into disclosing their credentials or downloading and executing malware onto their systems. Anomali and <a href="https://www.anomali.com/app-store" target="_blank">our partner ecosystem</a> have publicly released data and information to identify, monitor, and respond to the latest threats to thwart malicious Coronavirus (COVID-19) themed activity from impacting customer’s information systems and networks. In this latest blog, we detail how to collect the new and rich data source offered by Anomali partner <a href="https://www.anomali.com/resources/data-sheets/partner-data-sheet-domaintools" target="_blank">DomainTools</a> and how to operationalize this data within <a href="https://wwwlegacy.anomali.com/files/data-sheets/ThreatStream-Datasheet.pdf" target="_blank">ThreatStream</a>, the industry-leading Threat Intelligence Platform (TIP).</p><p><strong>Details</strong></p><p>On March 23, 2020, Anomali partner DomainTools released a free <a href="https://www.domaintools.com/resources/blog/free-covid-19-threat-list-domain-risk-assessments-for-coronavirus-threats#" target="_blank">COVID-19 Threat List</a>. In the list, users can find Coronavirus (COVID-19) malicious domain name permutations covering more than 60 relevant keywords such as Covid, c0vid, c0v1d, Corona, carona, and corrona. Moreover, the threat list filters out any domains below a <a href="https://www.domaintools.com/resources/videos/domain-risk-score-overview" target="_blank">Domain Risk Score</a> of 70. According to DomainTools, the Domain Risk Score is a proprietary machine-learning classifier to analyze the intrinsic properties of a domain, identifying patterns consistent with malware, phishing, spam, or neutral domains.<br/> MITRE Pre-ATT&CK Techniques: <a href="https://attack.mitre.org/techniques/T1328" target="_blank">Buy domain name (T1328)</a> | <a href="https://attack.mitre.org/techniques/T1397/" target="_blank">Spearphishing for Information (T1397)</a><br/> MITRE Enterprise ATT&CK Techniques: <a href="https://attack.mitre.org/techniques/T1193/" target="_blank">Spearphishing Attachment (T1193)</a> | <a href="https://attack.mitre.org/techniques/T1192/" target="_blank">Spearphishing Link (T1192)</a></p><p><img alt="" src="https://cdn.filestackcontent.com/ts7XQfrAS668HWOsrc85"/></p><p style="text-align: center;"><strong>Figure 1. Free COVID-19 Threat List - Domain Risk Assessments for Coronavirus Threats (Source: <a href="https://www.domaintools.com/resources/blog/free-covid-19-threat-list-domain-risk-assessments-for-coronavirus-threats" target="_blank">DomainTools</a>)</strong></p><p><br/> <strong>How Anomali Customers Leverage the COVID-19 Threat List</strong></p><p>The Anomali Threat Research team has curated the COVID-19 Threat List and imported the close to 65,000 suspicious and malicious domains into <a href="https://wwwlegacy.anomali.com/files/data-sheets/ThreatStream-Datasheet.pdf" target="_blank">ThreatStream</a> to help customers protect and defend their organizations. Anomali empowers our customers to operationalize and take action on this data in multiple ways such as:</p><ul><li>Identify attack trends, map out the adversary’s infrastructure, and discover tactics, techniques, and procedures employed by adversaries using the <a href="https://www.anomali.com/products" target="_blank">Investigations Workbench</a> and <a href="https://www.anomali.com/blog/unlock-your-threat-data-with-the-enrichment-sdk" target="_blank">Enrichments</a> within <a href="https://wwwlegacy.anomali.com/files/data-sheets/ThreatStream-Datasheet.pdf" target="_blank">ThreatStream</a></li><li>Automate threat intelligence ingestion and deployment to downstream security systems via <a href="https://wwwlegacy.anomali.com/files/ThreatStream_Integrator.pdf" target="_blank">Integrator</a> to proactively block access to high-risk COVID-19 themed domains at their organization’s defensive technologies</li><li>Correlate high-risk COVID-19 themed domains against internal event logs using <a href="https://anomali.cdn.rackfoundry.net/files/data-sheets/Anomali-Match-datasheet.pdf" target="_blank">Anomali Match</a> to identify current and historical sightings indicative of a compromised host or network</li><li>Ingest the domains into their Security Information and Event Management (SIEM) instances such as <a href="https://wwwlegacy.anomali.com/files/data-sheets/anomali-splunk-response-app.pdf" target="_blank">Splunk</a> to automatically scan events against the observables associated to the Coronavirus (COVID-19) Cyber Threats Threat Bulletin</li><li>Use <a href="https://www.anomali.com/isacs-sharing" target="_blank">Trusted Circles</a> as a mechanism for real-time threat intelligence sharing and collaboration with industry peers and sharing groups to maintain situational awareness and establish community-based protections on a specific Campaign, adversary, or Incident </li><li>Use <a href="https://anomali.cdn.rackfoundry.net/files/Anomali_Lens_Analysts_Datasheet.pdf" target="_blank">Anomali Lens</a> to determine if there are any observables in the aforementioned article (and others during their research) that are relevant to their environment by scanning the page and seeing if there are any Matches</li></ul><p>Of note, this Threat Bulletin was announced on <a href="https://www.anomali.com/blog/anomali-aggregates-open-source-threat-intelligence-to-fight-covid-19-themed-cyber-attacks" target="_blank">March 24, 2020</a> and provides our customers with a steady stream of new, actionable intelligence.</p><p><img alt="" src="https://cdn.filestackcontent.com/SKjibiUZSKKKOxZTMR6S"/></p><p style="text-align: center;"><strong>Figure 2. ThreatStream Observables Search page filtered on DomainTools - COVID-19 Threat List</strong></p>
Deliver COVID-19 Intelligence to Your Security Controls
Malicious actors continue to leverage the global Coronavirus (COVID-19) pandemic to register phishing and malware domains to lure unsuspecting users into disclosing their credentials or downloading and executing malware onto their systems. Anomali and our partner ecosystem have publicly released data and information to identify, monitor, and respond to the latest threats to thwart malicious Coronavirus (COVID-19) themed activity from impacting customer’s information systems and networks. In this latest blog, we detail how to collect the new and rich data source offered by Anomali partner DomainTools and how to operationalize this data within ThreatStream, the industry-leading Threat Intelligence Platform (TIP).
Details
On March 23, 2020, Anomali partner DomainTools released a free COVID-19 Threat List. In the list, users can find Coronavirus (COVID-19) malicious domain name permutations covering more than 60 relevant keywords such as Covid, c0vid, c0v1d, Corona, carona, and corrona. Moreover, the threat list filters out any domains below a Domain Risk Score of 70. According to DomainTools, the Domain Risk Score is a proprietary machine-learning classifier to analyze the intrinsic properties of a domain, identifying patterns consistent with malware, phishing, spam, or neutral domains.
MITRE Pre-ATT&CK Techniques: Buy domain name (T1328) | Spearphishing for Information (T1397)
MITRE Enterprise ATT&CK Techniques: Spearphishing Attachment (T1193) | Spearphishing Link (T1192)
Figure 1. Free COVID-19 Threat List - Domain Risk Assessments for Coronavirus Threats (Source: DomainTools)
How Anomali Customers Leverage the COVID-19 Threat List
The Anomali Threat Research team has curated the COVID-19 Threat List and imported the close to 65,000 suspicious and malicious domains into ThreatStream to help customers protect and defend their organizations. Anomali empowers our customers to operationalize and take action on this data in multiple ways such as:
- Identify attack trends, map out the adversary’s infrastructure, and discover tactics, techniques, and procedures employed by adversaries using the Investigations Workbench and Enrichments within ThreatStream
- Automate threat intelligence ingestion and deployment to downstream security systems via Integrator to proactively block access to high-risk COVID-19 themed domains at their organization’s defensive technologies
- Correlate high-risk COVID-19 themed domains against internal event logs using Anomali Match to identify current and historical sightings indicative of a compromised host or network
- Ingest the domains into their Security Information and Event Management (SIEM) instances such as Splunk to automatically scan events against the observables associated to the Coronavirus (COVID-19) Cyber Threats Threat Bulletin
- Use Trusted Circles as a mechanism for real-time threat intelligence sharing and collaboration with industry peers and sharing groups to maintain situational awareness and establish community-based protections on a specific Campaign, adversary, or Incident
- Use Anomali Lens to determine if there are any observables in the aforementioned article (and others during their research) that are relevant to their environment by scanning the page and seeing if there are any Matches
Of note, this Threat Bulletin was announced on March 24, 2020 and provides our customers with a steady stream of new, actionable intelligence.
Figure 2. ThreatStream Observables Search page filtered on DomainTools - COVID-19 Threat List
