Borderless Threat Intelligence - using External Threat Intelligence for Brand and Supply Chain Monitoring

This past year was the year of the data breach. Large and small organizations across every industry vertical were impacted by compromises that ranged from theft of PII, intellectual property, and financial information to publication of entire backend databases and email spools.

The data from these breaches often wound up being exposed publicly, exchanged or sold on underground markets, or simply leveraged to breach other organizations.

Many of these breaches have cascading effects due to the transitive nature of security that exists across companies, as the rely on critical business partners, subsidiaries and other organizations whose services are trusted.

Additionally, password reuse across customer accounts involved in a third-party data dump could enable unauthorized access to another business’ assets.

Threat intelligence can be used to gain visibility and combat some of these issues. External threat intelligence can be leveraged to use information about events not occurring on your own network in order to detect breaches or threats to your brand or supply chains. Below are some specific items that can help:

Suspicious Domain Name Monitoring

Adversaries are increasingly acquiring domain names that resemble either a company they want to target or a brand they want to leverage to social engineer victims. Registering typo squatted domains and homoglyph domains is not new and there are some great open source tools, such as urlcrazy and dnstwist, to do this.

However, many organizations are not monitoring for the presence of these domains in their environment or the registrations of these domains as they occur.

Adversaries often use the following techniques when acquiring these domains – here are some examples techniques applied to the domain “”:

  • Keyboard Typo –
  • Character omission –,
  • Character insertion –,
  • Homoglyph –,
  • Character Swap –
  • Missing dot or replacing dot with dash –,,,
  • Deceptive token insertion –,,
  • Different TLD –,,

Mass Credential Exposures

"Mass Credential Exposures"

Increasingly, script kids, hacktivists and cyber criminals are dumping huge collections of usernames and passwords publicly on the dark web or for sale on underground marketplaces. Often times, these dumps contain corporate email addresses and passwords that were found when a third-party website was compromised through SQL injection or other weaknesses.

Because password reuse is so rampant and many organizations still don’t use Multi-Factor Authentication (MFA), these exposures can put you at risk. Monitoring for mass credential exposures affecting your company or any supply chain company you depend on is very useful for reducing these risks.

Network Cleanliness Monitoring

Are IPs from the network space you own/control showing up on threat feeds of machines that are scanning, brute forcing, DDoS-ing, sending spam, connecting to DNS sinkholes, or hosting malicious content?

What about the IPs of your executive’s home networks? Or the IPs of your critical supply chain or business partners?

If so, you may have a compromised system that you were unaware of and it may put your company at risk. Monitoring threat intelligence feeds for these items can give you a warning that something is not right so action can be taken.

"Network Cleanliness Monitoring"

Have you checked what sites like Shodan, ZoomEye, and Censys have about your networks or your critical supply chains’ networks? Are there vulnerable or unexpected services running? These sites’ data is public so anyone, including malicious actors, can and do review it – so should you.

Network cleanliness monitoring can take many shapes from monitoring threat intelligence feeds to querying public portscan/web crawl repositories to actually running the network scans yourself but the goals are to identify systems and services that are either vulnerable, unexpected, or compromised.

Signs of Targeting and Social Networking Data-mining

Are you or your supply chain being discussed as a target on social media or the DarkWeb? Have any public threats been made? Is there malicious software purpose-built to target your company or your supply chain?

Monitoring what is being shared and discussed on both social media and the DarkWeb forums as it pertains to your company can provide an an early warning before an attack is carried out.

"Signs of targeting and social networking data-mining"

Credential Exposure Posting from the Hell Darkweb forum


The first step for operationalizing these concepts is building an inventory of yourself and your critical supply partners. The following information should be collected and kept up-to-date:

  • Email domains names
  • Internal and external domain names, especially for sensitive resources
  • Company’s IP address space
  • Brand names
  • Personal email addresses of key executives
  • IP address space of key executives’ home networks
  • Names of key executives

The next step is identifying data sources that you have or that you can acquire that provide the visibility you want. These data source should include:

  • Internal DNS logs, web proxy logs
  • Threat Intelligence feeds
    • Honeypot data
    • Malware C2 Sinkhole data
    • Spammer feeds
    • Portscan/web crawl data
  • Paste sites (e.g. pastebin and others)
  • DeepWeb/DarkWeb monitoring
  • Social media sites
  • Google/Bing searches

The final step is setting up collection and processing of the different data sources to look for instances of items from your inventory showing up. Security Information and Event Management (SIEM) or log management platforms are often useful places to perform these actions.

If you don’t have one of these, simple scripts that grep the data may be sufficient (it really depends on the size of your network and the volume of data). There are commercial services that can provide this, as well.

If you would like to learn more about these concepts and how to operationalize them, please check out the presentation I gave at the 2016 R-CISC Retail Summit below.

R-CISC Summit 2016 Borderless Threat Intelligence from Jason Trost

Note: this was originally published here.

This is a really quick post. No analysis or commentary, just some links to papers I found interesting. These are from some conferences (WOOT, NDSS, ACM CCS, ASAC) from this year.

Tick Tock: Building Browser Red Pills from Timing Side Channels. WOOT 2014.

The Sniper Attack: Anonymously Deanonymizing and Disabling the Tor Network. NDSS 2014.

Amplification Hell: Revisiting Network Protocols for DDoS Abuse. NDSS 2014.

Zippier ZMap: Internet-Wide Scanning at 10 Gbps. WOOT 2014.

Through the Looking-Glass, and What Eve Found There. WOOT 2014.

The End is Nigh: Generic Solving of Text-based CAPTCHAs. WOOT 2014.

Uncovering Network Tarpits with Degreaser (slides)

SEER: Practical Memory Virus Scanning as a Service

Scalability, Fidelity and Stealth in the DRAKVUF Dynamic Malware Analysis System

Protecting Client Browsers with a Principal-based Approach

From Patches to Honey-Patches: Lightweight Attacker Misdirection, Deception, and Disinformation

Your Online Interests – Pwned! A Pollution Attack Against Targeted Advertising. ACM CCS 2014

The Web Never Forgets: Persistent Tracking Mechanisms in the Wild. ACM CCS 2014

A Systematic Approach to Developing and Evaluating Website Fingerprinting Defenses. ACM CCS 2014

Characterizing Large-Scale Click Fraud in ZeroAccess. ACM CCS 2014

(Nothing else) MATor(s): Monitoring the Anonymity of Tor’s Path Selection. ACM CCS 2014

Acoustic Fingerprinting Revisited: Generate Stable Device ID Stealthy with Inaudible Sound

Beyond Pattern Matching: A Concurrency Model for Stateful Deep Packet Inspection. ACM CCS 2014

A Critical Evaluation of Website Fingerprinting Attacks. ACM CCS 2014

To Find:

AutoProbe: Towards Automatic Active Malicious Server Probing Using Dynamic Binary Analysis An Epidemiological Study of Malware Encounters in a Large Enterprise

Update (1/1/2017): I will not be updating this page and instead will make all updates to this page: The Definitive Security Data Science and Machine Learning Guide (see Machine Learning and Security Papers section).

Over the past several years I have collected and read many security research papers/slides and have started a small catalog of sorts. The topics of these papers range from intrusion detection, anomaly detection, machine learning/data mining, Internet scale data collection, malware analysis, and intrusion/breach reports. I figured this collection might useful to others. All links lead to PDFs hosted here.

I hope to clean this up (add author info, date, and publication) when I get some more time as well as adding some detailed notes I have on the various features, models, algorithms, and datasets used in many of these papers.

Here are some of my favorites (nice uses of machine learning, graph analytics, and/or anomaly detection to solve interesting security problems):

Here is the entire collection:

Intrusion Detection


Data Collection

Vulnerability Analysis/Reversing


Data Mining

Cyber Crime



This is an awesome collection of Security Data Science ipython notebooks from @clicksecurity.

They demonstrate using Pandas, Scikit-Learn, and Matplotlib for exploring security datasets involving:

  • Detecting Algorithmically Generated Domains
  • Hierarchical Clustering of Syslogs
  • Exploration of data from Malware Domain List
  • SQL Injection
  • Browser Agent Fingerprinting


Mubix (@mubix) used the subdomains list from here to bruteforce subdomains using dig and args. Really nice use of xargs for parallel execution.

cat subdomains.txt | \
	xargs -P 122 -I subdomain dig +noall +answer