ReversingLabs Ransomware and Related Tools Feed

Details

ID	`ReversingLabs Ransomware and Related Tools Feed`
Provider	ReversingLabs
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Overview

ReversingLabs Ransomware and Related Tools Feed includes fresh indicators from not only ransomware but the tools used
to gain access and deploy ransomware enabling defenders the opportunity to discover adversaries initial network access
and lateral movement before their data is encrypted. Our threat intelligence researchers analyze ransomware attack
trends and the security landscape to ensure that only the most up to date and relevant malware families are dissected
to create technical indicators.

The user can set the initial fetch time to go historically up to 4 hours back. Each following fetch calculates the
historical time dynamically by itself so no indicators are missed.

Configuring

Upon installing the ReversingLabs Ransomware and Related Tools Feed integration, do the following:

Navigate to Settings > Integrations > Servers & Services.
Search for ReversingLabs Ransomware and Related Tools Feed.
Click Add instance to create and configure a new integration instance.

After creating an instance of the integration, click on the cog icon and configure the following parameters:

Parameter	Description
Name	A name for the integration instance.
Fetch indicators	If checked, the instance fetches indicators.
ReversingLabs TitaniumCloud URL	The host address of ReversingLabs TitaniumCloud. Default is “https://data.reversinglabs.com”
Credentials	Username for the ReversingLabs TitaniumCloud.
Password	Password for the ReversingLabs TitaniumCloud.
Indicator Reputation	Indicators from this integration instance will be marked with this reputation. Default is “Bad”.
Source Reliability	Defines the reliability of the source providing the intelligence data. Default is “A - Completely reliable”
Indicator Expiration Method	The method by which to expire indicators from this feed for this integration instance.
Indicator Expiration Interval	How often to expire the indicators from this integration instance expressed in minutes.
Feed Fetch Interval	How often to fetch indicators from the feed for this integration instance expressed in hours and minutes. Default and recommended is 1 hour.
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
First fetch time	Defines how many hours back in time should the indicators be fetched from during the first run. Value should be between 1 and 4. Recommended value is 2.
Indicator types	Which types of indicators should be fetched from the feed. Possible values are ‘ipv4’, ‘domain’, ‘hash’, ‘uri’.
Tags	Tags added by the user that will be appended to the indicator tags. Tags need to be separated by a comma with no spaces.
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
Trust any certificate (not secure)	If checked, the server certificate integrity will be ignored.

When the parameters are configured, click “Test”.
If the test succeeds, click “Done” to finish configuring the instance.

Commands

The commands in this feed integration can be executed manually from the Cortex XSOAR CLI, or as a part of an automation or a playbook.

Get indicators from the feed

reversinglabs-get-indicators

Available arguments

Argument Name	Description	Required
limit	The maximum number of indicators to return. Default is 50.	Optional
indicator_types	Which indicator types should be fetched from the feed. Possible values are ‘ipv4’, ‘domain’, ‘hash’, ‘uri’. The default is “ipv4,domain,hash”.	Optional
hours_back	Defines how many hours hours back in time should the indicators be fetched from. Value should be between 1 and 4. Recommended value is 1.	Optional

Context and readable output

Depending on the indicator type and each specific indicator, context and readable output can have varying data fields. Full available list of output fields is the following:

Field	Type
Indicator Value	String
Indicator Type	String
Days Valid	Integer
Confidence	Integer
Rating	Decimal
Indicator Tags	Object
Last Update	Timestamp
Deleted	Boolean
Hash	Object

Indicator Tags object

Field	Type
port	String
malwareType	String
lifecycleStage	String
malwareFamilyName	String
source	String
mitre	List
Protocol	List of strings
asn	String
fileInfo	List of strings

Hash object

Field	Type
sha1	String
md5	String
sha256	String

Context prefix

ReversingLabs.indicators

Command example

!reversinglabs-get-indicators limit="40" indicator_types="ipv4,hash" hours_back="2"

Configuration parameters

feed — Fetch indicators
host — ReversingLabs TitaniumCloud URL (required)
credentials — Credentials (required)
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
hours — First fetch time
indicatorTypes — Indicator types
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feedTags — Tags
tlp_color — Traffic Light Protocol Color

Commands (1)

reversinglabs-get-indicators
Gets indicators from the feed.

Source

ReversingLabsRansomwareAndRelatedToolsFeed.py ReversingLabsRansomwareAndRelatedToolsFeed_test.py ReversingLabsRansomwareAndRelatedToolsFeed.yml

Download History Raw

from ReversingLabsRansomwareAndRelatedToolsFeed import create_indicator_object, confidence_to_score, return_validated_params


RL_INDICATOR = {
    "indicatorValue": "197.232.50.85",
    "indicatorType": "ipv4",
    "daysValid": 30,
    "confidence": 100,
    "rating": 4.0,
    "indicatorTags": {
        "lifecycleStage": "Middle",
        "malwareType": "Trojan",
        "malwareFamilyName": "TrickBot",
        "mitre": [
            "T1071 Application Layer Protocol",
            "T1095 Non-Application Layer Protocol",
            "T1105 Ingress Tool Transfer",
            "T1573 Encrypted Channel",
        ],
        "source": "ReversingLabs",
        "port": ["TCP-443"],
        "asn": "AS36866::KE::JTL",
    },
    "lastUpdate": "2022-01-19T14:48:03Z",
    "deleted": False,
    "uuid": "indicator--4b827068-3ea0-567d-99ba-ec8ed160d1f7",
}


XSOAR_INDICATOR = {
    "value": "197.232.50.85",
    "type": "IP",
    "rawJSON": RL_INDICATOR,
    "fields": {
        "lastseenbysource": "2022-01-19T14:48:03+00:00",
        "malwaretypes": "Trojan",
        "malwarefamily": "TrickBot",
        "port": ["TCP-443"],
        "asn": "AS36866::KE::JTL",
        "tags": [
            "T1071 Application Layer Protocol",
            "T1095 Non-Application Layer Protocol",
            "T1105 Ingress Tool Transfer",
            "T1573 Encrypted Channel",
            "Middle",
            "ReversingLabs",
            "MyCustomTag",
            "AnotherCustomTag",
        ],
    },
    "score": 3,
}


PARAMS = {"hours": 7, "indicatorTypes": ["ipv4", "domain", "hash", "uri"]}


def test_confidence_to_score():
    assert confidence_to_score(85) == 3
    assert confidence_to_score(15) == 2
    assert not confidence_to_score(1)


def test_create_indicator_object():
    indicator = create_indicator_object(
        rl_indicator=RL_INDICATOR, user_tag_list=["MyCustomTag", "AnotherCustomTag"], tlp_color_param=None
    )

    assert indicator == XSOAR_INDICATOR


def test_return_validated_params():
    hours_historical, indicator_types_param = return_validated_params(params=PARAMS)

    assert hours_historical <= 4
    assert isinstance(indicator_types_param, str)
    assert indicator_types_param == ",".join(PARAMS.get("indicatorTypes"))

ReversingLabs Ransomware and Related Tools Feed Deprecated