September 26th, 2024 - Gemini AI and Dark Web Monitoring improvements

Artificial Intelligence
Dark web monitoring

Artificial Intelligence

Code Insight file support expansion including Batch, Shell, VBScript, and Office documents. Code Insight is a cutting-edge feature powered by Gemini AI that leverages artificial intelligence for code analysis. It is a malware analyst/reverse engineer assistant that produces natural language summaries of file capabilities and intent. We’ve extended it to support more file formats such as Batch, Shell, VBScript, Office documents and more. We are also experimenting with Windows Executables, example - Code Insight was able to reverse engineer and analyze the decompiled code of the WannaCry malware in a single pass — and identify the killswitch — in only 34 seconds.

This analysis is also indexed and exposed for searching with the codeinsight modifier, example search: type:powershell codeinsight:keylogger.

Gemini AI Search - Google Threat Intelligence’s search capabilities allow users to look for any particular IoC (file hash, domain, URL or IP address), IoCs matching certain static/dynamic/reputational/code criteria and high order threats (actors, malware, campaigns, vulnerabilities, etc.). We’ve extended search so that users can ask natural language questions to get a generative AI-powered overview of a topic based on our Google Threat Intelligence curated knowledge. You can even interact with Gemini and ask follow up questions on any given subject. Learn more and get some examples here.

Online threat articles summarization and entity extraction. Google Threat Intelligence is all about providing the deepest and broadest knowledge on threats. Our Mandiant experts produce curated finished intelligence based on differentiated frontline visibility into breaches, at the same time, we ingest 3rd-party articles and any kind of online references through direct connection to the Google crawler. We are now leveraging Gemini AI to automatically ingest, label and summarize OSINT articles to reduce time to investigate and create actionable threat intelligence research. As we identify and ingest articles, we automatically extract and index notions such as: related actors, source regions, targeted regions, targeted industries, motivations, etc. This information enters our knowledge base and becomes searchable, and, at the same time, it automatically contextualizes any IoCs that may be referenced in the pertinent articles.

Dark web monitoring

Dark web data leak expansion. Digital Threat Monitoring (DTM) is a dark web monitoring Google Threat Intelligence module to help customers identify emerging threats in hard to reach (typically inaccessible) places on the Internet. DTM allows you to define and monitor certain threat scenarios such as impersonation of your brand, compromised credentials, supply chain compromise, etc. We’ve extended DTM with a data leaks monitor allowing you to detect exposure of your sensitive information such as financial data, trade secrets, or customer information. This monitor also acts on the daily 2M+ VirusTotal file submissions, allowing you to identify exposures beyond your perimeter, be it because employees inadvertently uploaded sensitive information to the platform or because researchers have found it in underground communities and notified it via VirusTotal.

Expanded compromised credentials context One of the threat scenarios available in DTM is Compromised Credentials, which monitors for leaked usernames and passwords across the deep, dark, web. We’ve extended the context on identified compromises, in addition to the threat/malware name related to the compromise, credential alerts for verified login email domain matches now show victim IP address, country, hostname and OS for additional context and faster action. The new context allows users to better understand how the specific machines were compromised whenever the credential theft is tied to malware.

Enhancements to credential monitoring matching logic. In the aforementioned DTM module, we have made some critical enhancements to our credential monitoring logic. Given that “email domain in the login field” matches have highest true-positives for employee credentials, we recommend creating at least two separate monitors. The first for “email domain in the login field” and a second for “web service” matches.

• “Web service” matches may alert on employee credentials and/or end-user credentials.
• Where possible, we recommend creating separate monitor groups for domains that are known for employee-only credentials and those are end-user-only credentials.
  

UX enhancements for dark web alerting to allow for easier alert exportability. Now supporting additional formats for export: csv, json.