Skip to main content

Threat hunting

Discover and discuss how to use Censys and other tools to find and track emerging threats

  • 8 Topics
  • 7 Replies
8 Topics
AidanH_Censys
AidanH_CensysCensys Team
posted in Threat hunting
Join Censys and Greynoise for an in-person threat hunting workshop in Washington, DC!

Hey everyone! On October 29, 2024 we are holding an in-person threat hunting workshop in Washington, D.C. I want to extend an invite to the folks here in the Censys Community. The workshop will provide an opportunity to learn from industry experts and other Censys users through hands-on exercises and discussions, offering insights and strategies to get the most from your security technology. I will be leading the workshop alongside Andrew Morris from Greynoise. We will cover… Malicious Infrastructure Discovery and Fingerprinting Deceptive Services/Honeypot Detection If you work in the threat intel and response world, are a security engineer, or are more broadly in the cybersecurity analyst industry, this workshop will be perfect for you.You can request an invite to the event here. Hope to see you there!

460
AidanH_Censys
3 months ago
glennt
glenntNew Member
posted in Threat hunting
ICYMI: A mysterious and increasingly concerning phenomenon since January 2020: massive waves of spoofed traffic, known as “Noise Storms.”

We (GreyNoise) are investigating a long-standing mystery and reaching out to anyone who may have thoughts, theories, or insights! https://www.greynoise.io/blog/greynoise-reveals-new-internet-noise-storm-secret-messages-and-the-china-connection 

280
glennt
3 months ago
L
Lembright_CensysCensys Team
posted in Threat hunting
Analysis Uncovers Hidden Infrastructure of Iranian Fox Kitten Group

 “at the end of the day, it’s not actually computer-to-computer, right?” he said. “The technology is a vector for human beings. Behind the connection is a person." - Nate Fick,  US State’s ambassador for cyber.Using this mentality, and the fact that humans have patterns, I dug into IOCs from the Joint Cybersecurity Advisory on Iranian threat actor group “Fox Kitten” to uncover hosts that shared either identical IOCs or similar patterns (ports, software, certificates, DNS, etc) and therefore, are likely part of their infrastructure that wasn’t mentioned in the report. Check out the analysis here.Specifically, a search for domain IOCs from the Advisory yielded the following IPs with those IOCs in their DNS and certificate records. These IPs were not listed in the Advisory yet share Autonomous Systems/networks with host IOCs that are listed in the Advisory, further linking them to the group.“Host M” - 64.176.165[.]17 “Host N” - 70.34.218[.]77 “Host O” - 18.130.251[.]165What does this mean

741
MattK_Censys
3 months ago
M
MrTiTiNew Participant
asked in Threat hunting
Ogre Routing - Hunting for Nodes of Ogre Nodes

Hello! We are trying to map IPs in our address space to OGRE router nodes and TOR nodes. Do you know of any way to investigate this through Censys or do you know of any sources of information related to this?Here are some links on the subject of Ogre Routing, with some similarities to TOR Routing:-https://github.com/NthMetal/ogre-router/blob/master/README.md-https://github.com/NthMetal/ogre-router-server Thanks!

491
MattK_Censys
4 months ago
M
Matthew Embee ResearchNew Participant
posted in Threat hunting
Sharing Techniques For Hunting Open Directories

Hey All, I recently published a guide to hunting open directories alongside Censys.It dives into ways you can use queries to find open directories with Malware, and shows how you can find things like ransomware files and cobalt strike. If anyone has any questions or needs any guidance trying it out, feel free to post a comment and I’ll help out where I can :) https://censys.com/a-beginners-guide-to-hunting-open-directories/

1522
B
5 months ago
AidanH_Censys
AidanH_CensysCensys Team
posted in Threat hunting
Stumbling Upon XehookStealer C2 Instances

While reevaluating the VIPER C2 fingerprint after reading this topic. (Shout out @fopwn)  I started checking the logic of Agniane Stealer which could be discovered with the following query. services: (http.response.favicons.md5_hash="ef05ae61e6cfce0f261635b68bacd524" and http.response.body: "https://t.me/agniane") Historical Virtual Host - Running on Cloudflare We haven’t seen any Agniane Stealer in some time so I decided to look at hosts with the string "https://t[.]me/agniane" in the HTTP body. I got 11 results but none of them were labeled as Agniane Stealer.    However, only one was a raw host that wasn’t behind Cloudflare, 193.149.190[.]2.  Looking at the Markdown preview I am able to see there is a header “xehook.stealer” and the same Telegram channel /agniane. XehookStealer is a piece of known malware as a service infostealer that targets Windows systems. It also uses SmokeLoader binaries for distribution. It has overlapping code with Agniane Stealer, that I now confidently can

1462
B
5 months ago
F
fopwnNew Participant
posted in Threat hunting
Hunting VIPER C2 Instances on Censys

man viper-huntHey all, this just serves as a quick way to hunt down some VIPER C2 instances if this is something you’re interested in tracking. I’ve tweeted about this previously so this will be a recap/update with some new hosts. Hunt.io also has a really good blog on their site about hunting on their platform, but I posted my tweet two months before their article so… take that VC investors. IntroductionFor some background, VIPER C2 is a framework primarily used by Asian TAs and is rarely hosted in any NATO/FVEY countries. Using IP geolocation alone can already help narrow down some more interesting hosts to look at without the need for any deep pivoting. A notable APT that has historically used VIPER is NAIKON/Lotus Panda, especially in combination with Asset Reconnaissance Lighthouse. So, how can we track VIPER instances? Very easily, we abuse TA laziness. The Basic PathBased on the Hunt article and maybe some cursory manual glances, you could easily come up with a basic query based

3860
F
5 months ago
TheGift73
TheGift73New Participant
asked in Threat hunting
EASM Threat Hunting Best Practices

Hi,I was wondering what is the best way to start doing some External Attack Surface threat hunting for a specific organisation using Censys using the free community account type. Are there good way to start doing this whilst reducing any potential false positives, such as looking for a specific version of PHP seen on a server/machine rather than just PHP as a whole?

1021
MattK_Censys
6 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings
Censys logo

censys.com | Knowledge Base | Censys Search | Contact Us