MISP-URL-DiamondFoxPanels.txt

let MISPFeed = externaldata(Row: string)[@"https://raw.githubusercontent.com/pan-unit42/iocs/master/diamondfox/diamondfox_panels.txt"] with (format="txt", ignoreFirstRecord=True);
let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
let MaliciousDomain = materialize (
       MISPFeed 
       // extract the url or ip from a website https://10.10.10.10/malware.exe will return 10.10.10.10 and https://malicious.zip/malware.exe will return malicious.zip
       | extend DomainOrIP = extract(@'//(.*?)/', 1, Row)
       | extend DomainOrIPToLower = tolower(DomainOrIP)
       | where not(DomainOrIPToLower matches regex IPRegex)
       | distinct DomainOrIP
        );  
DeviceNetworkEvents
| where RemoteIP has_any (MaliciousDomain)
| project-reorder TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName