ReversingLabs Ransomware and Related Tools Feed

Details

ID	`ReversingLabs Ransomware and Related Tools Feed`
Provider	ReversingLabs
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Overview

ReversingLabs Ransomware and Related Tools Feed includes fresh indicators from not only ransomware but the tools used
to gain access and deploy ransomware enabling defenders the opportunity to discover adversaries initial network access
and lateral movement before their data is encrypted. Our threat intelligence researchers analyze ransomware attack
trends and the security landscape to ensure that only the most up to date and relevant malware families are dissected
to create technical indicators.

The user can set the initial fetch time to go historically up to 4 hours back. Each following fetch calculates the
historical time dynamically by itself so no indicators are missed.

Configuring

Upon installing the ReversingLabs Ransomware and Related Tools Feed integration, do the following:

Navigate to Settings > Integrations > Servers & Services.
Search for ReversingLabs Ransomware and Related Tools Feed.
Click Add instance to create and configure a new integration instance.

After creating an instance of the integration, click on the cog icon and configure the following parameters:

Parameter	Description
Name	A name for the integration instance.
Fetch indicators	If checked, the instance fetches indicators.
ReversingLabs TitaniumCloud URL	The host address of ReversingLabs TitaniumCloud. Default is “https://data.reversinglabs.com”
Credentials	Username for the ReversingLabs TitaniumCloud.
Password	Password for the ReversingLabs TitaniumCloud.
Indicator Reputation	Indicators from this integration instance will be marked with this reputation. Default is “Bad”.
Source Reliability	Defines the reliability of the source providing the intelligence data. Default is “A - Completely reliable”
Indicator Expiration Method	The method by which to expire indicators from this feed for this integration instance.
Indicator Expiration Interval	How often to expire the indicators from this integration instance expressed in minutes.
Feed Fetch Interval	How often to fetch indicators from the feed for this integration instance expressed in hours and minutes. Default and recommended is 1 hour.
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
First fetch time	Defines how many hours back in time should the indicators be fetched from during the first run. Value should be between 1 and 4. Recommended value is 2.
Indicator types	Which types of indicators should be fetched from the feed. Possible values are ‘ipv4’, ‘domain’, ‘hash’, ‘uri’.
Tags	Tags added by the user that will be appended to the indicator tags. Tags need to be separated by a comma with no spaces.
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
Trust any certificate (not secure)	If checked, the server certificate integrity will be ignored.

When the parameters are configured, click “Test”.
If the test succeeds, click “Done” to finish configuring the instance.

Commands

The commands in this feed integration can be executed manually from the Cortex XSOAR CLI, or as a part of an automation or a playbook.

Get indicators from the feed

reversinglabs-get-indicators

Available arguments

Argument Name	Description	Required
limit	The maximum number of indicators to return. Default is 50.	Optional
indicator_types	Which indicator types should be fetched from the feed. Possible values are ‘ipv4’, ‘domain’, ‘hash’, ‘uri’. The default is “ipv4,domain,hash”.	Optional
hours_back	Defines how many hours hours back in time should the indicators be fetched from. Value should be between 1 and 4. Recommended value is 1.	Optional

Context and readable output

Depending on the indicator type and each specific indicator, context and readable output can have varying data fields. Full available list of output fields is the following:

Field	Type
Indicator Value	String
Indicator Type	String
Days Valid	Integer
Confidence	Integer
Rating	Decimal
Indicator Tags	Object
Last Update	Timestamp
Deleted	Boolean
Hash	Object

Indicator Tags object

Field	Type
port	String
malwareType	String
lifecycleStage	String
malwareFamilyName	String
source	String
mitre	List
Protocol	List of strings
asn	String
fileInfo	List of strings

Hash object

Field	Type
sha1	String
md5	String
sha256	String

Context prefix

ReversingLabs.indicators

Command example

!reversinglabs-get-indicators limit="40" indicator_types="ipv4,hash" hours_back="2"

Configuration parameters

feed — Fetch indicators
host — ReversingLabs TitaniumCloud URL (required)
credentials — Credentials (required)
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
hours — First fetch time
indicatorTypes — Indicator types
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feedTags — Tags
tlp_color — Traffic Light Protocol Color

Commands (1)

reversinglabs-get-indicators
Gets indicators from the feed.

Source

ReversingLabsRansomwareAndRelatedToolsFeed.py ReversingLabsRansomwareAndRelatedToolsFeed_test.py ReversingLabsRansomwareAndRelatedToolsFeed.yml

Download History Raw

commonfields:
  id: ReversingLabs Ransomware and Related Tools Feed
  version: -1
name: ReversingLabs Ransomware and Related Tools Feed
display: ReversingLabs Ransomware and Related Tools Feed
deprecated: true
category: Data Enrichment & Threat Intelligence
provider: ReversingLabs
description: Deprecated. Use TAXII 2 Feed to connect to the ReversingLabs Ransomware and Related Tools TAXII Feed.
configuration:
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
- display: ReversingLabs TitaniumCloud URL
  name: host
  defaultvalue: "https://data.reversinglabs.com"
  type: 0
  required: true
- display: Credentials
  name: credentials
  required: true
  type: 9
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
- additionalinfo: Reliability of the source providing the intelligence data
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- display: ""
  name: feedExpirationPolicy
  defaultvalue: indicatorType
  type: 17
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  required: false
- display: ""
  name: feedExpirationInterval
  defaultvalue: "20160"
  type: 1
  required: false
- display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
- display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  required: false
- display: First fetch time
  defaultvalue: 2
  name: hours
  type: 0
  additionalinfo: Defines how many hours back in time should the indicators be fetched from during the first run. Value should be between 1 and 4. Recommended value is 2.
  required: false
- display: Indicator types
  name: indicatorTypes
  defaultvalue: ipv4,domain,hash,uri
  additionalinfo: Which types of indicators should be fetched from the feed. Possible values are 'ipv4', 'domain', 'hash', 'uri'.
  type: 16
  options:
  - ipv4
  - domain
  - hash
  - uri
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
- name: tlp_color
  display: Traffic Light Protocol Color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  required: false
script:
  script: ''
  type: python
  commands:
  - name: reversinglabs-get-indicators
    arguments:
    - name: limit
      defaultValue: 50
      description: The maximum number of indicators to return. The default value is 50.
    - name: indicator_types
      defaultValue: 'ipv4,domain,hash,uri'
      description: Which indicator types should be fetched from the feed. Possible values are 'ipv4', 'domain', 'hash', 'uri'.
    - name: hours_back
      defaultValue: 1
      description: Defines how many hours back in time should the indicators be fetched from. Value should be between 1 and 4. Recommended value is 1.
    description: Gets indicators from the feed.
  dockerimage: demisto/python3:3.12.8.3296088
  feed: true
  subtype: python3
fromversion: 6.0.0
tests:
- No tests (auto formatted)

ReversingLabs Ransomware and Related Tools Feed Deprecated