Kaspersky C&C Tracking CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Kaspersky C&C Tracking Feed

The Kaspersky C&C Tracking feed ingests IP Addresses of infrastructure connected to advanced threats and ASN data.

GET https://tip.kaspersky.com/api/apt_cnc/all

Sample Response:

[
  {
    "ip": "54.215.129.6" ,
    "first_seen": "2021-04-18" ,
    "last_seen": "2021-04-18" ,
    "country_code": "us" ,
    "tags": [
      {
        "name": "CobaltStrike" ,
        "source": null ,
        "type": "Organic" ,
        "description": "Cobalt Strike is a commercially available attack platform developed by Raphael Mudge and used by multiple threat actors."
      }
    ] ,
    "asn": 16509 ,
    "asn_name": "AMAZON-02" ,
    "ip_whois": {
      "net_range": "54.215.0.0 - 54.215.255.255" ,
      "net_name": "AMAZO-ZSFO2" ,
      "descr": null ,
      "created": "2013-03-19" ,
      "updated": "2013-03-19" ,
      "country": null ,
      "city": null ,
      "contact_owner_name": "Amazon.com, Inc." ,
      "contact_owner_code": "AMAZO-48" ,
      "contact_owner_country": "US" ,
      "contact_owner_city": "Seattle" ,
      "contact_owner_email": "amzn-noc-contact@amazon.com" ,
      "contact_abuse_name": "Amazon EC2 Abuse" ,
      "contact_abuse_country": null ,
      "contact_abuse_city": null ,
      "contact_abuse_email": "abuse@amazonaws.com" ,
      "net_asn": "16509"
    }
  } ,
  {
    "ip": "72.45.135.213" ,
    "first_seen": "2021-04-18" ,
    "last_seen": "2021-04-18" ,
    "country_code": "us" ,
    "tags": [
      {
        "name": "CobaltStrike" ,
        "source": null ,
        "type": "Organic" ,
        "description": "Cobalt Strike is a commercially available attack platform developed by Raphael Mudge and used by multiple threat actors."
      }
    ] ,
    "asn": 11351 ,
    "asn_name": "TWC-11351-NORTHEAST" ,
    "ip_whois": {
      "net_range": "72.45.128.0 - 72.45.255.255" ,
      "net_name": "RCACI" ,
      "descr": null ,
      "created": "2006-08-10" ,
      "updated": "2007-07-18" ,
      "country": null ,
      "city": null ,
      "contact_owner_name": "Time Warner Cable Internet LLC" ,
      "contact_owner_code": "RCNY" ,
      "contact_owner_country": "US" ,
      "contact_owner_city": "Herndon" ,
      "contact_owner_email": "abuse@rr.com" ,
      "contact_abuse_name": "Abuse" ,
      "contact_abuse_country": null ,
      "contact_abuse_city": null ,
      "contact_abuse_email": "abuse@rr.com" ,
      "net_asn": null
    }
  }
]

ThreatQuotient provides the following default mapping for this feed:

PDF Guides