DTM smart alert clustering. Google Threat Intelligence strives to tackle all threat intelligence use cases, including Digital Risk Protection, including our Digital Threat Monitoring component (DTM) focused on deep dark web visibility. DTM provides alerts about compromised credentials, data leaks, credit card theft, domain abuse and other potential risks. In an effort to reduce alert fatigue we are extending the smart alert grouping logic of the compromised credentials monitor to the entire DTM surface. Now, each alert will have a similarity score, if that score is 90% or higher to another alert (two alerts have mostly the same data in them), then they will be grouped together. Read more about alert grouping in our documentation.
DTM Gemini AI alert summarization. DTM alert views & alert lists now provide a short AI generated summary so that users can efficiently investigate external threats to their organization. This LLM output is provided in English and it is similar to the output of a capable junior SOC analyst - reliable and accurate, with enough distilled to enable the user to arrive at a correct judgment about what to do with the alert (close, follow up, etc). Read more about DTM alerts in our documentation.
Expanded trusted community detection contributions. Google Threat Intelligence’s differentiated threat visibility is built on Mandiant’s frontline engagements, VirusTotal’s industry + community aggregation and Google’s exhaustive internet visibility. As part of our efforts to continue to consolidate all of the industry’s knowledge about threats we have deployed new crowdsourced Sigma rules. As a refresher, crowdsourced Sigma rules act on the EVTX logs derived from sandbox file detonations and the corresponding matches are displayed in the Detection tab of the corresponding files. We’ve extended the pre-existing Sigma rule sources with RussianPanda’s Sigma rules, check out this example of a file with matches.
New (searchable) file behavior tags. Google Threat Intelligence detonates all the files it sees in home grown, open source and third-party sandboxes (dynamic analysis setups) that record actions such as network communication, registry activity, file process activity, etc. We map particularly interesting behaviors to tags for quick searching, for example: behavior_tags:calls_wmi. We have released new behavior tags such as qrcode that flags files that have displayed a QR code when executed, as identified in the pertinent sandbox screenshots. Full set of behavior modifiers: _big_upstream, calls_wmi, checks_bios, checks_cpu_name, checks_disk_space, checks_gps, checks_hostname, checks_memory_available, checks_network_adapters, checks_pci_bus, checks_usb_bus checks_user_input, clipboard, crypto, decrypts_exe, detect_debug_environment, direct_cpu_clock_access, eval_function, executes_dropped_file, ftp_communication, hosts_modifier, idle, installs_browser_extension, irc_communication, listens, long_sleeps, macro_anti_analysis, macro_copy_file, macro_create_dir, macro_create_file, macro_create_ole, macro_download_url, macro_enum_windows, macro_environ, macro_handle_file, macro_hide_app, macro_open_file, macro_powershell, macro_registry, macro_run_dll, macro_run_file, macro_save_workbook, macro_send_keys, macro_write_file, mysql_communication, obfuscated, password_dialog, persistence, qr_code, reflection, repeated_clock_access, runtime_modules, self_delete sends_sms, service_scan, sets_process_name, smtp_communication, ssh_communication, sudo, suspicious_dns, suspicious_udp, telephony, telnet_communication, tunneling.
Malware behavior Catalog for file detonations. One of Google Threat Intelligence’s strategic imperatives revolves around providing superior context and explainability about threats. We are now mapping all file dynamic analysis sandbox detonations to the Malware behavior Catalog (MBC), similar to the mappings that we already do to the MITRE ATT&CK Matrix. MBC is usually more effective at describing concrete malware behavior than ATT&CK given that ATT&CK applies to broader attacker activity. Refer to the “Malware Behavior Catalog tree” section of this file report in order to see an example. This information is also exposed via API by retrieving the behavior_mbc_trees relationship for file objects.
Search for files with a specific Malware behavior Catalog classification. Google Threat Intelligence allows its users to search across its massive IoC dataset with advanced search modifiers/facets describing reputational/static/dynamic/code/content properties. We’ve extended the available search modifiers with one named “mbc”, it matches the MBC catalog id and allows you to pinpoint files that exhibit a given MBC behavior, example: mbc:C0002.018 searches for files that start an HTTP server.
Malware behavior Catalog matching in Livehunt. Google Threat Intelligence allows its to write YARA rules that are matched against the incoming live stream of files uploaded to VirusTotal and other threat sources across Google properties, it is what we call Livehunt. In line with the MBC mapping described above we are now allowing users to match MBC output in Livehunt with the "vt" module. Example:
import "vt"
rule mbc_example {
condition:
for any catalog in vt.behavior.mbc: (
catalog.id == "C0002.018"
)
}
Livehunt and Retrohunt upgraded to YARA-X. YARA-X is a re-incarnation of YARA, our home-grown pattern matching tool designed with malware researchers in mind. This new incarnation intends to be faster, safer and more user-friendly than its predecessor. The ultimate goal of YARA-X is to serve as the future replacement for YARA. We have upgraded the Livehunt and Retrohunt clusters with YARA-X, this immediately exposes new modules for use within our Hunting component and makes development of new custom modules far easier.
Macho YARA module now supported in Livehunt & Retrohunt. As previously mentioned, Google Threat Intelligence allows its users to match its malware corpus with YARA rules, be it in a real-time fashion (Livehunt) or back in time (Retrohunt). The rules can act on any file type, including the more than 12K+ net new Mac OS X exceutables that we receive on a daily basis. The aforementioned move to YARA-X means that you can now use the “macho” module in order to match against advanced static and structural features of Mac OS X executables.
String and time YARA modules now supported in Livehunt & Retrohunt. Similar to the macho module, the upgrade to YARA-X has opened up the use of the string and time YARA modules.
Upgrade to MITRE v16.1. Google Threat Intelligence focuses on all types of threat intelligence: technical, tactical, operational, strategic. We build thorough curated profiles for threat actors, campaigns and malware families through Mandiant’s differentiated frontline visibility. These profiles include MITRE ATT&CK matrices to describe attacker activity. The techniques and tactics available on actor, malware, campaign, and TTP analysis objects are being updated to reflect MITRE version 16.1. This update introduces new and improved attacker technique classifications, including better characterization of Cloud-based adversary activity. Check this example to see where this information surfaces within profiles.
Improvements in searching within MITRE matrices. MITRE matrices on the aforementioned threat actor, campaign, malware family and TTP analysis views are now searchable. The search box above the matrix allows you to provide either a technique / subtechnique name/id and the matrix gets automatically updated to reflect your search criteria.
