MISP Initial Commit

MISP/Feeds/Defender For Endpoint/MISP-CVE-MetasploitExploits.txt

@@ -0,0 +1,8 @@
+let MetaSploitExploitsWithAssignedCVE = externaldata(cveid: string)[@"https://feeds.ecrimelabs.net/data/metasploit-cve"] with (format="txt", ignoreFirstRecord=True);
+DeviceTvmSoftwareVulnerabilities
+| where CveId in~ (MetaSploitExploitsWithAssignedCVE)
+| summarize
+     TotalVulnerabilities = dcount(CveId),
+     Vulnerabilities = make_set(CveId)
+     by DeviceName
+| sort by TotalVulnerabilities

MISP/Feeds/Defender For Endpoint/MISP-IP-AbuseCH-IPBlocklist.txt

@@ -0,0 +1,21 @@
+let MISPFeed = externaldata(IP: string)[@"https://feodotracker.abuse.ch/downloads/ipblocklist.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+     MISPFeed 
+     | where IP matches regex IPRegex
+     | distinct IP
+     );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder
+     Timestamp,
+     ActionType,
+     RemoteIP,
+     RemotePort,
+     LocalPort,
+     Protocol,
+     DeviceName,
+     InitiatingProcessCommandLine,
+     InitiatingProcessFolderPath

MISP/Feeds/Defender For Endpoint/MISP-IP-BlocklistDE.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://lists.blocklist.de/lists/all.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-CINSscore.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://cinsscore.com/list/ci-badguys.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-DiamondFoxPanels.txt

@@ -0,0 +1,15 @@
+let MISPFeed = externaldata(Row: string)[@"https://raw.githubusercontent.com/pan-unit42/iocs/master/diamondfox/diamondfox_panels.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed 
+       // extract the url or ip from a website https://10.10.10.10/malware.exe will return 10.10.10.10 and https://malicious.zip/malware.exe will return malicious.zip
+       | extend DomainOrIP = extract(@'//(.*?)/', 1, Row)
+       | extend DomainOrIPToLower = tolower(DomainOrIP)
+       | where DomainOrIPToLower matches regex IPRegex
+       | distinct DomainOrIP
+        );  
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-FeodoIPBlocklist.txt

@@ -0,0 +1,13 @@
+let MISPFeed = externaldata(Row: string)[@"https://feodotracker.abuse.ch/downloads/ipblocklist.csv"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed
+       | extend IP = extract(IPRegex, 0, Row)
+       | where isnotempty(IP)
+       | distinct IP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-IPSum-Level1.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://raw.githubusercontent.com/stamparm/ipsum/master/levels/1.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed 
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-IPSum-Level2.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://raw.githubusercontent.com/stamparm/ipsum/master/levels/2.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed 
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-IPSum-Level3.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed 
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-IPSum-Level4.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://raw.githubusercontent.com/stamparm/ipsum/master/levels/4.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed 
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-IPSum-Level5.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://raw.githubusercontent.com/stamparm/ipsum/master/levels/5.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed 
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-IPSum-Level6.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://raw.githubusercontent.com/stamparm/ipsum/master/levels/6.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed 
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-IPSum-Level7.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://raw.githubusercontent.com/stamparm/ipsum/master/levels/7.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed 
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-IPSum-Level8.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://raw.githubusercontent.com/stamparm/ipsum/master/levels/8.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed 
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-MiraiSecurity.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://mirai.security.gives/data/ip_list.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed 
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-IP-ProofPoint.txt

@@ -0,0 +1,12 @@
+let MISPFeed = externaldata(DestIP: string)[@"https://rules.emergingthreats.net/blockrules/compromised-ips.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousIP = materialize (
+       MISPFeed
+       | where DestIP matches regex IPRegex
+       | distinct DestIP
+        );
+DeviceNetworkEvents
+| where RemoteIP in (MaliciousIP)
+| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
+| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName

MISP/Feeds/Defender For Endpoint/MISP-MD5-AbuseCH-MalwareMD5.txt

@@ -0,0 +1,9 @@
+let MISPFeed = externaldata(MD5: string)[@"https://bazaar.abuse.ch/export/txt/md5/recent"] with (format="txt", ignoreFirstRecord=True);
+let MD5Regex = '[a-f0-9]{32}';
+let MaliciousMD5 = materialize (
+          MISPFeed 
+          | where MD5 matches regex MD5Regex
+          | distinct MD5
+          );
+DeviceFileEvents
+| where MD5 has_any (MaliciousMD5)

MISP/Feeds/Defender For Endpoint/MISP-URL-DiamondFoxPanels.txt

@@ -0,0 +1,13 @@
+let MISPFeed = externaldata(Row: string)[@"https://raw.githubusercontent.com/pan-unit42/iocs/master/diamondfox/diamondfox_panels.txt"] with (format="txt", ignoreFirstRecord=True);
+let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
+let MaliciousDomain = materialize (
+       MISPFeed 
+       // extract the url or ip from a website https://10.10.10.10/malware.exe will return 10.10.10.10 and https://malicious.zip/malware.exe will return malicious.zip
+       | extend DomainOrIP = extract(@'//(.*?)/', 1, Row)
+       | extend DomainOrIPToLower = tolower(DomainOrIP)
+       | where not(DomainOrIPToLower matches regex IPRegex)
+       | distinct DomainOrIP
+        );  
+DeviceNetworkEvents
+| where RemoteIP has_any (MaliciousDomain)
+| project-reorder Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName