Threat Hunting Guide Designed for SOC Analysts and MSSPs

Proactive threat hunting is a critical function for Security Operations Center (SOC) analysts and Managed Security Service Providers (MSSPs). Traditional detection methods may not effectively identify advanced adversarial techniques, necessitating the use of sophisticated tools and methodologies.

ANY.RUN’s Threat Intelligence Lookup (TI Lookup) provides analysts with precise insights into Indicators of Compromise (IOCs), Indicators of Behavior (IOBs), and Indicators of Attack (IOAs), derived from an extensive interactive sandbox environment.

TI Lookup offers access to a comprehensive malware database, enriched by contributions from over 500,000 sandbox users, including 15,000 corporate SOC teams. The platform allows up to 50 trial requests, with each query potentially returning hundreds of relevant sessions, samples, and artifacts. Key functions include:

IOC Lookups: Search file hashes, IP addresses, domain names, and URLs to verify suspicious artifacts. Behavioral Lookups: Identify registry modifications, process activities, network communications, and mutex creations to detect emerging threats without established IOCs. MITRE ATT&CK Integration: Query specific tactics, techniques, and procedures (TTPs) to align hunts with known adversary frameworks. File/Event Correlation: Discover relationships between disparate artifacts to expose broader attack campaigns. YARA-Based Queries: Conduct pattern-based searches for precise file characteristic matches. Advanced Query Syntax: Utilize over 40 parameters, wildcards, and logical operators (AND, OR, NOT, parentheses, *, ?, ^, $) for complex, contextual hunting scenarios.

Search results for malware changing Windows registry

Country-Based Detection: Geographic filtering (e.g., submissionCountry:”br” AND threatName:”phishing”) identifies regional phishing trends, while combining submissionCountry:”in” with commandLine:”powershell” and threatLevel:”malicious” highlights PowerShell-based attacks in India. MITRE Technique-Focused Queries:

Command & Script Execution (T1059): Using (MITRE:”T1059” AND (commandLine:”powershell” OR imagePath:”mshta.exe”)) surfaces sandbox events using PowerShell or mshta.exe. Registry Persistence (T1547): MITRE:”T1547” AND registryKey:”CurrentVersion\\Run” identifies malware auto-start behaviors via Windows registry.

Obfuscated File Behavior: Detect executables in non-standard directories with fileExtension:”exe” AND NOT filePath:”Windows*” AND NOT filePath:”Program Files*”. Identify script-based obfuscation using commandLine:”powershell” AND fileExtension:”js”. Persistence & Mutex Hunting: Find malware mutexes using syncObjectName:”rmc” to detect Remcos trojan instances. Domain Generation Algorithm (DGA) Detection: Target cheap-TLD DGAs with domainName:”.top” OR domainName:”.xyz” AND (destinationPort:”80” OR destinationPort:”443”) AND threatLevel:”malicious”. Identify Cloudflare-hosted phishing via domainName:”.workers.dev” AND threatLevel:”malicious”. Malware Family Behavior:

Formbook: threatName:”formbook” OR (MITRE:”T1055” AND registryKey:”CurrentVersion\\Run” AND fileExtension:”exe”). AsyncRAT: threatName:”asyncrat” AND (commandLine:”mshta.exe” OR commandLine:”powershell”).

Thematic Search Subscriptions: Receive automated alerts for credential stealer campaigns by subscribing to custom queries combining known stealer names with registry access patterns.

Integrating TI Lookup into SOC playbooks enables analysts to reduce Mean Time to Respond (MTTR) through rapid query responses, enrich alerts with comprehensive threat intelligence, and proactively identify unseen threats before escalation.

ANY.RUN’s TI Lookup provides SOC teams and MSSPs with actionable data necessary for informed decision-making, whether isolating regional attack patterns, focusing on specific MITRE techniques, or mapping complex multi-vector campaigns.

Based on reporting by GBHackers.