TweetFeed

Collecting Indicators Of Compromise (IOCs) posted on Twitter in order to search them in your environment.

#BlueTeam 🔵

Content

Data collected
Some statistics
How it works
Hunting IOCs via Microsoft Defender
Author
Disclaimer

Data collected

Feeds
2021-09-20 21:20:35 (UTC)
Today	Last 7 days	Last 30 days	Last 365 days
📋 Today (raw)	📋 Week (raw)	📋 Month (raw)	📋 Year (raw)

Output example

_{Date (UTC)}	_SourceUser	_Type	_Value	_Tags	_Tweet
_{2021-08-14 02:26:32}	_{phishunt_io}	_url	_{https://netflix.us2.cards/}	_{#phishing #scam}	_{https://twitter.com/phishunt_io/status/1426369619422502917}
_{2021-08-17 12:15:00}	_{TheDFIRReport}	_ip	_185.56.76.94	_#Trickbot	_{https://twitter.com/TheDFIRReport/status/1427604874053578756}

Some statistics

IOCs

IOC	Today	Week	Month	Year
🔗 URLs	248	2331	9458	12129
🌐 Domains	36	390	1423	1431
🚩 IPs	181	1563	6486	8161
🔢 SHA256	685	2888	5771	6466
🔢 MD5	10	72	301	381

Tag	Today	Week	Month	Year
#phishing	305	2897	12304	15799
#scam	28	248	1410	1643
#malware	71	498	2320	3362
#ransomware	2	18	92	120
#banker	0	1	5	5
#AgentTesla	60	242	844	966
#Alienbot	0	0	42	72
#BazarLoader	0	13	79	83
#CobaltStrike	70	712	2422	2501
#Dridex	522	1887	2893	2893
#FluBot	0	0	5	5
#Formbook	12	168	278	278
#GootLoader	4	63	63	63
#GuLoader	0	23	27	27
#Hancitor	0	20	25	25
#IceID	0	0	0	0
#Lazarus	0	0	0	0
#Lokibot	23	54	158	182
#ProxyShell	5	9	48	54
#Qakbot	1	2	2	2
#Raccoon	16	76	76	76
#RedLine	20	232	326	326
#Remcos	8	59	67	67
#SquirrelWaffle	11	23	23	23
#Trickbot	2	23	41	49
#Ursnif	5	14	63	82
#XLoader	0	0	0	0

Top reporters (today)

Number	User	IOCs
#1	RedBeardIOCs	647
#2	secbird1	122
#3	ecarlesi	82
#4	drb_ra	67
#5	HeliosCert	55
#6	KesaGataMe0	18
#7	PhishStats	12
#8	CardanoPhishing	12
#9	phishunt_io	10
#10	yvesago	9

How it works?

Search tweets that contain certain tags or that are posted by certain infosec people.

Tags being searched

(not case sensitive)

- #phishing
- #scam
- #malware
- #ransomware
- #banker
- #AgentTesla
- #Alienbot
- #BazarLoader
- #CobaltStrike
- #Dridex
- #FluBot
- #Formbook
- #GootLoader
- #GuLoader
- #Hancitor
- #IceID
- #Lazarus
- #Lokibot
- #ProxyShell
- #Qakbot
- #Raccoon
- #RedLine
- #Remcos
- #SquirrelWaffle
- #Trickbot
- #Ursnif
- #XLoader

Also search Tweets posted by

(these are trusted folks that sometimes don't use tags)

TweetFeed list

IOCs being collected

- URL
- Domain
- IP address
- SHA256 hash
- MD5 hash

Hunting IOCs via Microsoft Defender

1. Search SHA256 hashes with yearly tweets feed

let MaxAge = ago(30d);
let SHA256_whitelist = pack_array(
'XXX' // Some SHA256 hash you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type == 'sha256'
    | extend SHA256 = tostring(report[3])
    | where SHA256 !in(SHA256_whitelist)
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project SHA256, Tag, Tweet 
);
union (
    TweetFeed
    | join (
        DeviceProcessEvents
        | where Timestamp > MaxAge
    ) on SHA256
), (
    TweetFeed
    | join (
        DeviceFileEvents
        | where Timestamp > MaxAge
    ) on SHA256
), ( 
    TweetFeed
    | join (
        DeviceImageLoadEvents
        | where Timestamp > MaxAge
    ) on SHA256
) | project Timestamp, DeviceName, FileName, FolderPath, SHA256, Tag, Tweet

2. Search IP addresses with monthly tweets feed

let MaxAge = ago(30d);
let IPaddress_whitelist = pack_array(
'XXX' // Some IP address you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type == 'ip'
    | extend RemoteIP = tostring(report[3])
    | where RemoteIP !in(IPaddress_whitelist)
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project RemoteIP, Tag, Tweet 
);
union (
TweetFeed
    | join (
        DeviceNetworkEvents
    | where Timestamp > MaxAge
    ) on RemoteIP
) | project Timestamp, DeviceName, RemoteIP, Tag, Tweet

3. Search urls and domains with weekly tweets feed

let MaxAge = ago(30d);
let domain_whitelist = pack_array(
'XXX' // Some URL/Domain you want to whitelist.
);
let TweetFeed = materialize (
    (externaldata(report:string)
    [@"https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv"]
    with (format = "txt"))
    | extend report = parse_csv(report)
    | extend Type = tostring(report[2])
    | where Type in('url','domain')
    | extend RemoteUrl = tostring(report[3])
    | where RemoteUrl !in(domain_whitelist)
    | extend Tag = tostring(report[4])
    | extend Tweet = tostring(report[5])
    | project RemoteUrl, Tag, Tweet 
);
union (
TweetFeed
    | join (
        DeviceNetworkEvents
    | where Timestamp > MaxAge
    ) on RemoteUrl
) | project Timestamp, DeviceName, RemoteUrl, Tag, Tweet

Author

Daniel López

Disclaimer

Please note that all the data is collected from Twitter and sorted/served here as it is on best effort.

I have tried to tune as much as possible the searches trying to collect only valuable info. However please consider making your own analysis before taking any action related to these IOCs.

Anyway feel free to reach me out regarding any False Positive or to provide any kind of feedback.

By the Community for the Community

rootbatr / tweetfeed Goto Github PK

tweetfeed's Introduction