Open Source Security intelligence feeds

 List of open source security intelligence feeds to be used by various security products like Firewalls, IPS/IDS etc.

Credit goes to: https://logz.io/blog/open-source-threat-intelligence-feeds/

1 Emerging Threats

Developed and offered by Proofpoint in both open source and a premium version, The Emerging Threats Intelligence feed (ET) is one of the highest rated threat intelligence feeds. ET classifies IP addresses and domain addresses associated with malicious activity online and tracks recent activity by either. The feed maintains 40 different categories for IPs and URLs, as well as a constantly updated confidence score

2 Dan.me.uk

Dan is a collection of 10 tools that together report on IP and domain information. It includes info on IP subnets, the TOR status of IP addresses, DNS blacklists, IP address checking for autonomous systems, and node lists.

3 CINS Score

The CINS Score is supported by Sentinel. Like ET’s confidence score, the CINS Score rates IP addresses according to their trustworthiness. They add data about suspected or confirmed attacks from those IPs in the form of frequency, nature and breadth. They also try to create ‘personas’ around the sorts of attacks those IPs are tied to: scanning, network or remote desktop vulnerabilities, malware bots, or command-and-control servers.

4 Blocklist.de

Blocklist.de pays attention to server attacks from SSH, FTP, email and webserver sources. Their site claims to report an average of 70,000 attacks every 12 hours using a combo of the abusix.org database, Ripe-Abuse-Finder, and Whois information.

5 AlienVault OTX

AlienVault Open Threat Exchange (OTX) is the company’s free, community-based project to monitor and rank IPs by reputation. It generates alert feeds called “pulses,” which can be manually entered into the system, to index attacks by various malware sources. While some pulses are generated by the community, AlienVault creates its own as well that automatically subscribes all OTX’s users. Most pulses are automatically API-generated and submitted via the OTX Python SDK. This example, SSH bruteforce logs 2016-06-09, shows the indicators, geoip of the attacks, and a full list of the IPs used. It also links to reports in other pulses that include the same IPs.

6 Abuse.ch Feodo Tracker

This abuse.ch offering focuses on botnets and command-and-control infrastructure (C&C). The blocklist is an amalgamation of several minor blocklists with attention paid to Heodo and Dridex malware bots. There were 5,374 entries as of 03-03-2020.

Of course, the name itself is a direct response to an older trojan virus called Feodo, which was a successor to the Cridex e-banking trojan. (to which both Dridex and Heodo both trace their source code). Feodo Tracker also tracks an associative malware bot, TrickBot.

7 Abuse.ch URLhaus

The first of two projects from Swiss website abuse.ch, URLhaus is a depository of malicious domains tied to distributing malware. The database can be accessed via a URLhaus API, allowing you to download CSV collections of flagged URLs, those site’s respective statuses, the type of threat associated with them, and more. Ready-made downloads include periods of recent additions (going back 30 days), or all active URLs.

The full URLhaus dataset—as updated every 5 minutes—is automatically and immediately available for CSV download. It also includes a ruleset suited for use in Suricata or Snort. URLhaus also offers a DNS firewall dataset that includes all marked URLs for blocking.

 

Expressway Regex

 Credits for this article goes to https://www.collabarchitects.co/

 Test your Regex at https://regex101.com/

 

Example 1: Match a specific URI

 

.*@example.webex.com

 

We often use a regex like the one above to route calls to a specific URI.  In this case, we're matching anything with the domain example.webex.com.  Here's how we did it:

 

. matches any single character

 

* matches the character proceeding it zero or more times 

 

Thus .* would match any single character zero or more times

 

Add the domain @example.webex.com as a qualifier to only match the characters proceeding that specific domain.

 

Make sense?  Let's use an example:

 

jonathan@example.webex.com is a MATCH

 

jonathan123@example.webex.com is a MATCH

 

jonathan@acme.webex.com is NOT A MATCH, we are only matching URIs with the specific domain example.webex.com

 

Pretty simple, right?

 

Example 2: Match all URIs EXCEPT a specific URI

 

(?!.*@example\.com*$).*

 

This regex is often used to match all domains that are not the local domain (i.e. external domains).  In the above example, we're matching everything except example.com.  Here's how we did it:

 

( ) nests characters for grouping

 

.* matches all characters (remember our previous example?)

 

Thus, the regex reads: check the expression in the ( ) and otherwise match everything .* 

 

Do you understand thus far?  If not, go back to our first example. Now comes the interesting part:

 

?  matches zero or one occurrence of a pattern; thus ba?b matches bb and bab, but not baab

 

?! is an advanced regex called a lookaround.  More importantly, it's a negative lookahead.  Negative lookaheads require that a specific pattern NOT be met in the expression to the right.  In this case, we require example.com to not be in the expression for a match.

 

\ is an escape for a special character.  In our example, we want . in .com to be matched and thus need to use the \ 

 

* matches the character proceeding it zero or more times

 

$ matches the character or null string at the end of an input string; thus 123$ matches 0123, but not 1234

 

Thus, the regex ?!.*@example\.com*$ is read: exclude any expression matching .*@example.com

 

Let's put it all together: (?!.*@example\.com*$).* should be read: exclude any URI with the domain example.com but match all other URIs

 

Make sense?  Let's use an example:

 

jonathan@example.com is NOT A MATCH

 

jonathan123@example.com is NOT A MATCH

 

jonathan@acme.com is a MATCH

 

That one was a bit tougher, lookarounds are not for the faint of heart.  Grab a cup of coffee, let's start looking at using regex replacement strings.

Example 2: Use Replace

 

The Replace function in Expressway transforms is exceedingly useful when you need to modify an inbound URI or set of digits.  For example, we often want Expressway registered endpoints to dial a 5 digit internal numbers and route to CUCM.  To properly route, we need to take the 5 digit sting and convert to a URI.  Here's how we did it:

 

Match Pattern String: \d{5}

Behavior: Replace

Replacement String: \1@example.com

 

\d matches any single digit.  The {5} modifies the meaning to match any set of 5 digits.  Thus, 12345 matches but 123456 does not.

 

\1 matches the same text as was most recently matched.  In our case, it matches the same 5 digits that were matched in the first string.

 

Thus, the regex: \d{5} replace \1@example.com should be read; match any five digits and add example.com to the domain.

 

Make sense?  Let's use an example:

 

55555 is a MATCH which outputs 55555@example.com

 

666666 is NOT A MATCH

 

jonathan@example.com is NOT A MATCH

 

 

How about another example?  Here we want to match any 10 digit number dialed, excluding a number starting with 0, and add a domain to convert a digit string into a URI.  This would allow a video endpoint to dial a 10-digit PSTN number.

 

Match Pattern String: ([^0]*)

Behavior: Replace

Replacement String: \10@example.com

 

Let's start with the matching pattern string: ([^0]*)

 

( ) nests characters for grouping

 

[ ] match characters or a range of characters separated by a hyphen.  Thus, [1-9] matches 1,2,3 but not 0

 

^ matches the character or null string at the beginning of an input string.  Thus, ^123 matches 1234 but not 01234

 

Thus, the regex ([^0]*)​ is read: exclude any expression starting with 0 but match everything else.

 

Now, time for the replacement string: \10@example.com

 

\ when used in a replacements string, matches the number of characters following the backslash

 

Let's put it all together: ([^0]*) Replace \10@example.com should be read: match any expression not starting with 0 and create a URI with the first 10 digits and example.com as the domain.

 

Make sense?  Let's use an example:

 

8162223333 is a MATCH which outputs 8162223333@example.com

 

081622333 is NOT A MATCH

 

jonathan@example.com is NOT A MATCH

 

Palo Alto firewall URL whitelist

Just wanted to included a reference for declaring URL keywords for Whitelisting / blocking URL's in PA firewalls

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/url-filtering/block-and-allow-lists

FTD policy configuration delpoy failed

Make sure that FlexConfig is proper.
Remove all policies (NAT/ FlexConfig/ Access etc). and create empty ones and assign them to the device, then push the policy, if this works try to enabled original policies one by one to pinpoint the issue.

FTD Configuration Reset

I recently run into an issue that I needed to clear the configuration on a FTD 2100 series .

The steps followed are

1. Remove the FTD from FMC
2. SSH to FTD 
3. configure manager delete
4. You will be prompted to reset the configuration, choose yes
5.  configure firewall transparent
6.  Check configuration is clear and..
7. configure firewall routed

Now you have a FTD with clear configuration.


Another way is to connect to FTD and run the following

1. connect local-mgmt
2. erase configuration

This will reset the configuration and you have to go through the setup again after you reboot the device. Keep in mind that FTD instance will be reinstalled after that.

Palo Alto Firewall CLI admin access setup

Hi,

I run into an issue where a customer couldn't access his firewall via HTTPS and SSH. Somehow management access rules and services got disabled.

Using the console do the following (adjust to your environment & requirements)
configure
set deviceconfig system permitted-ip 10.0.0.0/8
set deviceconfig system service disable-telnet no
set deviceconfig system service disable-http no
set deviceconfig system service disable-ssh no
set deviceconfig system service disable-https no
commit
 

Check URLs opened in a web page

Recently I was called to adjust a firewall rule to allow access to 2 specific URL's only and nowhere else.
So I created a expression for the 2 specific URL and tested to see if it's working.

Guess what, it didn't! So further looking in to the issue I discovered that the specific developers had used more than a dozen domain to fetch images, scripts, ads, fonts, style sheets etc.

In order to test that I used the developer tools included in Firefox and Chrome, to access the tools either use the menu on each browser and locate them under tools or use Ctrl+Shift+I to open the console. Then select network and visit the page from an non restricted computer and disable any ad blockers that you might use.

Record all the domains and try to whitelist them in your rule.

It's a try and error procedure but helps especially if you are dealing with slow responding 3rd parties etc.

ICMP DoS attack Blacknurse

Black nurse is an ICMP DoS attack witch can bring systems down with a little as 18Mbps traffic.
As they state "it CAN bring you down"

More at blacknurse.dk