Hello, welcome to the Thursday, July 14th, 2016 edition of the Sansonet Storms and a stormcast. My name is Johannes Ulrich and today I'm recording from Jackson, Florida. With the big search and interest in threat intelligence, one part that often gets lost is how to make threat intelligence actually actionable.

So not just collect the data, but actually applied to hunt for infected systems into your environment.

Now, with the large amount of threat intelligence that's available,

it's sometimes tricky to actually then push out all these indicators of compromise and actually search through your systems for anything that may match.

Well, Xavier has an interesting script today that he posted about.

In this script, he uses MISP, which is actually a real great system in itself it does allow you to

collect and exchange threat intelligence with other organizations but Xavier really took

this a step further and created a script that will turn indicators collected by MISP into data that can then be used

with OSEC in order to hunt for infected systems.

OSEC has a feature that allows you to search for hashes in your environment and that's essentially

what he does.

He's just adapting MISP data into OSAC data. Pretty neat. So if you're already familiar with those two systems, that's a pretty straightforward and simple thing to do.

And well, if you're looking for compromised systems in your environment, why not start with your triple servers? And there is more reason to believe that they may be compromised because there are now a number of new

PHP arbitrary code execution vulnerabilities in add-ons commonly used with Truple.

So make sure you're not running any of the vulnerable add-ons here and well

maybe the commission that triple site while you're added. Tor is of course still the

number one way how people are trying to stay anonymous on the internet even though

over the last few years there have been a couple of cases where it has

been shown that this anonymity is not perfect in many cases the attack is actually

less against Tor but more against client systems for example by injecting

JavaScript at Tor endpoints but even the more sophisticated traffic analysis methods,

they all have in common that an attacker needs to have access to a good number of Tor notes and

...