Put Threat Intelligence Into Action With Security Apps

It’s now easier than ever to make threat intelligence from IBM X-Force Exchange actionable. Since its inception in 2015, X-Force Exchange has provided both granular indicators of compromise and higher-order intelligence through public collections to help shorten security investigations.

A recent update to the X-Force Exchange collaborative platform now offers recommended apps from the companion IBM Security App Exchange, based on the content of public collections, to help users implement threat intelligence into their end-to-end security portfolio.

Implementing Threat Intelligence

The Petya ransomware campaign in Europe earlier this year worked quickly. With the attack intending to destroy data rather than hold it hostage, every minute mattered. By using the recommendation engine on X-Force Exchange, users researching the “Petya Ransomware Campaign” public collection on IBM X-Force can now view related apps from App Exchange that can help put threat intelligence on Petya into action.

Users of the IBM X-Force Exchange will now see suggested apps from the App Exchange relevant to the content they are viewing.

In this case, the Threat Intelligence app for QRadar will add real-time threat intelligence from X-Force Exchange into the IBM QRadar SIEM — including any related reports on IP addresses and known malware hashes. In addition, the RFISI app provides additional rules in QRadar that implement the Threat Intelligence integration strategy and the NotPetya Content Pack adds additional detection based on Snort signatures and collaboratively developed threat intelligence to offer higher-fidelity detection of the NotPetya variant.

Full Circle Recommendations

Existing app users on App Exchange visiting the page for a particular app will now find related apps at the bottom of the page from both IBM and our network of security partners. If you visit any of the apps related to the Petya Ransomware Campaign Collection, you’ll discover recommended apps for additional threat intelligence sources, including those from partners such as Jeskell CyberSentinel, FireEye, PhishMe, ThreatConnect and more.

Learn More About IBM X-Force Exchange

https://www.ibm.com/us-en/marketplace/ibm-xforce-exchange

Security Intelligence Staff

img test

7 min read - test imgWhat is Lorem Ipsum? Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages,…

GootBot – Gootloader’s new approach to post-exploitation

8 min read - IBM X-Force discovered a new variant of Gootloader — the "GootBot" implant — which facilitates stealthy lateral movement and makes detection and blocking of Gootloader campaigns more difficult within enterprise environments. X-Force observed these campaigns leveraging SEO poisoning, wagering on unsuspecting victims' search activity, which we analyze further in the blog. The Gootloader group’s introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using off-the-shelf tools for C2…

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Implementing Threat Intelligence

Full Circle Recommendations

More from Threat Intelligence

img test

GootBot – Gootloader’s new approach to post-exploitation

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

Topic updates