Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Kaspersky Threat Intelligence CDF ingests threat intelligence data from Kaspersky Threat Intelligence.

The CDF ingests threat data from the following feeds:

• Kaspersky Botnet C&C URL Exact - ingests indicators and malware together with their attributes.
• Kaspersky Phishing URL Exact - ingests sets of web address masks covering phishing websites and web pages.
• Kaspersky Malicious URL Exact - ingests sets of web address masks covering malicious websites and web pages..
• Kaspersky Ransomware URL - ingests sets of web addresses, domains, and hosts covering ransomware links and websites.
• Kaspersky IoT URL - ingests sets of web addresses covering websites used to host malware that infect Internet of Things (IoT) devices. Hashes of the malware are also provided.
• Kaspersky Mobile Botnet C&C URL - ingests set of web addresses covering mobile botnet C&C servers.
• Kaspersky Malicious Hash - returns a list of STIX bundles, each of them containing Indicators related in TAXII_Malicious_Hash_Data_Feed_Indicators (stix2) collection.
• Kaspersky Mobile Malicious Hash - ingests sets of file hashes covering the detection of malicious objects that infect mobile Android and iPhone platforms.
• Kaspersky ICS Hash - ingests sets of file hashes with corresponding context covering the most dangerous, prevalent, or emerging malware that infect devices used in ICS.
• Kaspersky IP Reputation - ingests sets of IP addresses covering malicious hosts.
• Kaspersky APT IPs - ingests sets of IP addresses that are part of infrastructure used in malicious APT campaigns.
• Kaspersky APT URLs - ingests sets of domains that are part of an infrastructure used in malicious APT campaigns.
• Kaspersky APT Hashes - ingests sets of hashes covering malicious artifacts used by APT actors to conduct APT campaigns.

The integration ingests the following system objects:

• Indicators
  • Indicator Attributes
• Malware
  • Malware Attributes
• Signatures

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration yaml file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the integration yaml file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the file on your local machine
6. Select the individual feeds to install, when prompted, and click Install.

   ThreatQ will inform you if the feed already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the feed contains changes to the user configuration. The new user configurations will overwrite the existing ones for the feed and will require user confirmation before proceeding.

The feed(s) will be added to the integrations page. You will still need to configure and then enable the feed(s).

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   APT Hashes Parameters

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Kaspersky ID Attribute	Enable this parameter to ingest the Kaspersky ID attribute.
   Include Actors Attribute	Enable this parameter to ingest the Actor attribute.
   Include Geolocation Attribute	Enable this parameter to ingest the Geolocation attribute.
   Include Industries Attribute	Enable this parameter to ingest the Industries attribute.
   Include Object Relationships	When enabled, relationships will be created between ingested objects.

   
   

   APT IPs Parameters

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Kaspersky ID Attribute	Enable this parameter to ingest the Kaspersky ID attribute.
   Include Actors Attribute	Enable this parameter to ingest the Actor attribute.
   Include Geolocation Attribute	Enable this parameter to ingest the Geolocation attribute.
   Include Industries Attribute	Enable this parameter to ingest the Industries attribute.

   
   

   APT URLs Parameters

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Kaspersky ID Attribute	Enable this parameter to ingest the Kaspersky ID attribute.
   Include Actors Attribute	Enable this parameter to ingest the Actor attribute.
   Include Geolocation Attribute	Enable this parameter to ingest the Geolocation attribute.
   Include Industries Attribute	Enable this parameter to ingest the Industries attribute.

   
   

   Botnet C&C URL Exact Parameters

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Object Relationships	When enabled, relationships will be created between ingested objects.
   Include Kaspersky ID Attribute	Enable this parameter to ingest the Kaspersky ID attribute.
   Include Actors Attribute	Enable this parameter to ingest the Actor attribute.
   Include Geolocation Attribute	Enable this parameter to ingest the Geolocation attribute.
   Include Industries Attribute	Enable this parameter to ingest the Industries attribute.

   
   

   ICS Hash

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Object Relationships	When enabled, relationships will be created between ingested objects.
   Include Whois Attribute	When enabled, the Whois attribute is ingested.
   Include Kaspersky ID Attribute	When enabled, the Kaspersky ID attribute is ingested.
   Include Generic Malware	When enabled, malware with the Generic name will be ingested.

   
   

   IoT URL Parameters

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Object Relationships	When enabled, relationships will be created between ingested objects.
   Include Whois Attribute	When enabled, the Whois attribute is ingested.
   Include Kaspersky ID Attribute	When enabled, the Kaspersky ID attribute is ingested.
   Include Generic Malware	When enabled, malware with the Generic name will be ingested.

   
   

   IP Reputation

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Object Relationships	When enabled, relationships will be created between ingested objects.
   Include Whois Attribute	When enabled, the Whois attribute is ingested.
   Include Kaspersky ID Attribute	When enabled, the Kaspersky ID attribute is ingested.
   Include Generic Malware	When enabled, malware with the Generic name will be ingested.

   
   

   Malicious URL Exact Parameters

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Object Relationships	When enabled, relationships will be created between ingested objects.
   Include Whois Attribute	When enabled, the Whois attribute is ingested.
   Include Kaspersky ID Attribute	When enabled, the Kaspersky ID attribute is ingested.
   Include Generic Malware	When enabled, malware with the Generic name will be ingested.

   
   

   Mobile Botnet C&C URL Parameters

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Object Relationships	When enabled, relationships will be created between ingested objects.
   Include Whois Attribute	When enabled, the Whois attribute is ingested.
   Include Kaspersky ID Attribute	When enabled, the Kaspersky ID attribute is ingested.
   Include Generic Malware	When enabled, malware with the Generic name will be ingested.

   
   

   Phishing URL Exact Parameters

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Object Relationships	When enabled, relationships will be created between ingested objects.
   Include Whois Attribute	When enabled, the Whois attribute is ingested.
   Include Kaspersky ID Attribute	When enabled, the Kaspersky ID attribute is ingested.
   Include Generic Malware	When enabled, malware with the Generic name will be ingested.

   
   

   Ransomware URL Parameters

   Parameter	Description
   Kaspersky PEM File	Your Kaspersky Client Certificate for authentication.
   Entries	The number of entries to be retrieved.  The default is set to 10,000,000.
   Discard Data Older Than	Discard data based on the first_seen and last_seen fields to reduce load. Option include: 1 Day (default) 2 Days 5 Days 7 Days All Time
   Include Object Relationships	When enabled, relationships will be created between ingested objects.
   Include Whois Attribute	When enabled, the Whois attribute is ingested.
   Include Kaspersky ID Attribute	When enabled, the Kaspersky ID attribute is ingested.
   Include Generic Malware	When enabled, malware with the Generic name will be ingested.

   
   

   Malicious Hash Parameters

   Parameter	Description
   Username	Your Kaspersky TAXII service username.
   Password	Your Kaspersky TAXII service token.
   Verify SSL	Enable or disable verification of SSL connections with the provider.
   Disable Proxies	If enabled, the feed will not honor proxy settings within ThreatQ.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

[
    {
        "bot_urls": [
            {
                "bot_url": "one.saltapparel.club/accept.php"
            }
        ],
        "category": "Malware",
        "domains": [
            {
                "domain": "saltapparel.club"
            }
        ],
        "files": [
            {
                "MD5": "51D2B6222891CD0F444C1CF8E542A003",
                "SHA1": "E18F994827E26C2393832532142BB99D611B0B82",
                "SHA256": "EEF0CABE42B36B9544DD8E3BB3ACE0002D82579DDD4E40060C2397D510CD5EAE",
                "threat": "Trojan.Win32.Generic.go"
            },
            {
                "MD5": "CC7755D599A83C3CC1A56334D9398CB8"
            }
        ],
        "first_seen": "12.11.2019 13:46",
        "geo": "ru, de, in, dz, fr, it, br, vn, pl, ua",
        "hosts": [
            {
                "host": "one.saltapparel.club"
            }
        ],
        "id": 39724587,
        "industry": "Global Internet Portal",
        "IP": "54.88.21.193, 143.95.237.77, 146.112.51.207, 66.253.35.206",
        "last_seen": "29.03.2020 11:40",
        "mask": "saltapparel.club",
        "popularity": 5,
        "port": 80,
        "protocol": "http",
        "threat": "Trojan.Win32.Generic",
        "type": 1,
        "urls": [
            {
                "url": "one.saltapparel.club/offer.php"
            }
        ],
        "whois": {
            "country": "PA",
            "created": "12.11.2019",
            "domain": "saltapparel.club",
            "email": "please query the rdds service of the registrar of record identified in this output for information on how to contact the registrant, admin, or tech contact of the queried domain name.",
            "expires": "12.11.2020",
            "MX": "eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com, eforward4.registrar-servers.com, eforward5.registrar-servers.com",
            "MX_ips": "162.255.118.51, 162.255.118.52, 162.255.118.61, 162.255.118.62",
            "NS": "dns1.registrar-servers.com, dns2.registrar-servers.com",
            "NS_ips": "156.154.132.200, 156.154.133.200",
            "org": "WhoisGuard, Inc.",
            "registrar_email": "abuse@namecheap.com",
            "registrar_name": "NameCheap, Inc.",
            "updated": "17.11.2019"
        }
    },
    ...
]

{
    "type": "bundle",
    "id": "bundle--8cb6812e-9ed2-4257-aaf9-84b3a14060d2",
    "spec_version": "2.0",
    "objects": [
        {
            "type": "indicator",
            "spec_version": "2.0",
            "id": "indicator--605539c9-8e34-439f-a5eb-419972ea46d2",
            "created": "2023-11-28T01:03:51.687Z",
            "modified": "2023-11-28T01:03:51.687Z",
            "labels": [
                "malicious-activity"
            ],
            "confidence": 100,
            "name": "Hash",
            "description": "date_added=2023-11-28T01:03:51.687Z;file_size=4268;file_type=Eml;first_seen=2023-11-28T00:02:00.000Z;geo=jp;last_seen=2023-11-28T00:41:00.000Z;popularity=2;threat=HEUR:Hoax.Script.Scaremail.gen",
            "pattern": "[file:hashes.MD5 = '605539C98E34339FA5EB419972EA46D2' OR file:hashes.'SHA-256' = '16A6CF6D77CD00632C807EB739F4DAF0B8DBCDE65C5D4194FEBEE83E526F7D9F']",
            "valid_from": "2023-11-28T01:03:51.687000Z",
            "valid_until": "2100-01-01T00:00:00.000000Z"
        }
  ]
}

[
    {
        "file_names": "kmservice.exe, keygen.exe, kmsact.exe, act_office14_kms.exe, mini-kms_activator_v1.052.exe, mini-kms_activator_v1.051.exe, 12, upx, o1.6.exe, mini-kms_activator_v1.1_office.2010.vl.eng.exe",
        "file_size": 77824,
        "file_type": "PE",
        "first_seen": "15.11.2017 00:00",
        "geo": "br, tw, dz, ru, de, cn, ma, th, vn, es",
        "IP": "177.74.57.151, 36.91.164.33, 213.13.26.154, 82.64.49.223",
        "last_seen": "31.03.2020 10:51",
        "MD5": "82865FF17BC664C711EFA674759F9991",
        "popularity": 5,
        "SHA1": "1603F72897CBD81F473A906C328A83C0413C5FB5",
        "SHA256": "F85CD6F93BA18E642D50BEC7FC6AEB9D8751CC49B3BE5650DD5C556628545524",
        "threat": "HackTool.Win32.KMSAuto.i",
        "urls": [
            {
                "url": "nuvem.belem.pa.gov.br/remote.php/dav/files/ca91a71e-7d52-102c-8242-ade1aef9bba1/projetos-cad/arquivos suporte_cinbesa/renato back/software-win7-office-2010/office 2010 pt-br x86/ativador/ativador/activator_v1.052.rar"
            },
            {
                "url": "smkn1cikampek.poweredbyclear.com/data/software/iso/office2010/creck/keygen.exe"
            }
        ]
    },
    ...
]

[
    {
        "id": 56226423,
        "ip": "23.106.122.148",
        "detection_date": "12.08.2022 00:00",
        "publication_name": "BluePants: a new malicious framework hits Pan-Asia – Part II",
        "geo": "Central Asia, Indonesia, Kazakhstan, Malaysia, Philippines, Southeast Asia, Taiwan, Thailand",
        "industries": "Software development, Telecommunications",
        "api_publication_id": "c402bfac-1b7d-4525-760f-03b000baf00b-apt",
        "confidence": 25
    },
    ...
]

[
    {
        "id": 56226455,
        "mask": "login.dptuoguan.com",
        "type": 2,
        "detection_date": "12.08.2022 00:00",
        "publication_name": "BluePants: a new malicious framework hits Pan-Asia – Part II",
        "geo": "Central Asia, Indonesia, Kazakhstan, Malaysia, Philippines, Southeast Asia, Taiwan, Thailand",
        "industries": "Software development, Telecommunications",
        "api_publication_id": "c402bfac-1b7d-4525-760f-03b000baf00b-apt",
        "confidence": 25
    },
    ...
]

[
    {
        "id": 56226535,
        "MD5": "3E9DC9C5939DE2F0DF6F5CCF48D423BE",
        "SHA1": "D23896558706BDBA3D5A3A49B756EF0E2C563D75",
        "SHA256": "3056C9014E500C35F67EA66E9DDB605F44C9B7D45574B8328967CA03823ADC95",
        "detection_date": "12.08.2022 00:00",
        "publication_name": "BluePants: a new malicious framework hits Pan-Asia – Part II",
        "geo": "Central Asia, Indonesia, Kazakhstan, Malaysia, Philippines, Southeast Asia, Taiwan, Thailand",
        "industries": "Software development, Telecommunications",
        "api_publication_id": "c402bfac-1b7d-4525-760f-03b000baf00b-apt",
        "confidence": 100
    },
    ...
]

[
    {
        "category": "malware",
        "domains": "a.top4top.io, 1.top4top.io",
        "files": [
            {
                "MD5": "07690B14706EA196171069A8A63D358A",
                "SHA1": "05888E5B6829E31CA4345579B5EC386D9A8DDCCB",
                "SHA256": "343875A9A6265FEE8D28FA180094B0A6B9A53ED8B671189E3B5B4009BBEC51F4",
                "threat": "UDS:DangerousObject.Multi.Generic"
            },
            {
                "MD5": "C603006543FFB7F3096183C8558FC991",
                "SHA1": "7C6DA0D4595545EDE0E0A43392F647336355F7EF",
                "SHA256": "1262E31895447A2F1E94E3FD325EF7CE965E23826A0606A30DAFB15F6A2E2BBC",
                "threat": "UDS:DangerousObject.Multi.Generic"
            }
        ],
        "first_seen": "12.12.2019 02:23",
        "ip": "163.172.219.20",
        "ip_geo": "nl",
        "ip_whois": {
            "asn": 49981,
            "contact_abuse_country": "US",
            "contact_abuse_email": "xengine@mail.ru",
            "contact_abuse_name": "Abuse",
            "contact_owner_city": "Seattle",
            "contact_owner_code": "HUN8",
            "contact_owner_country": "EC",
            "contact_owner_email": "xengine123@mail.ru",
            "contact_owner_name": "ONLINE SAS",
            "country": "AU",
            "created": "28.08.2015",
            "descr": "Early registration addresses",
            "net_name": "ERX-NETBLOCK",
            "net_range": "163.0.0.0 - 163.255.255.255",
            "updated": "28.08.2015"
        },
        "last_seen": "31.03.2020 12:23",
        "popularity": 5,
        "threat_score": 100,
        "users_geo": "dz, sa, fr, eg, ma, br, om, ae, ps, iq"
    },
    ...
]

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Kaspersky Botnet C&C URL Exact

Kaspersky Phishing URL Exact

Kaspersky Malicious URL Exact

Kaspersky Ransomware URL

Kaspersky IoT URL

Kaspersky Mobile Botnet C&C URL

Kaspersky Malicious Hash

Kaspersky Mobile Malicious Hash

Kaspersky ICS Hash

Kaspersky APT IPs

Kaspersky APT URLs

Kaspersky APT Hashes

Kaspersky IP Reputation

Change Log

• Version 2.2.7
  • Added Include Industries Attribute, Include Geolocation Attribute, Include Actors Attribute, and Include Kaspersky ID Attribute parameters to the following feeds:
    • Kaspersky APT IPs
    • Kaspersky APT IPs
    • Kaspersky APT URLs
    • Kaspersky APT Hashes
  • Removed irrelevant configuration parameters from the following feeds:
    • Kaspersky APT IPs
    • Kaspersky APT IPs
    • Kaspersky APT URLs
    • Kaspersky APT Hashes  
• Version 2.2.6
  • Updated the Kaspersky Malicious Hash feed to retrieve data via TAXII.  This resolves an issue where the feed was not ingesting data on scheduled runs.
  • Updated the minimum ThreatQ version to 5.20.0
• Version 2.2.5
  • Added the following new configuration options:
    • Include Object Relationships
    • Include Whois Attribute
    • Include Kaspersky ID Attribute
    • Include Generic Malware
  • Removed the Exclude Object Relationships configuration option.
• Version 2.2.4
  • Added new configuration option: Exclude Object Relationships.  This option allows you to control whether or not the integration will create relationships between ingested objects. 
• Version 2.2.3
  • Added Confidence as an attribute to the following APT feeds: APT IP, APT Hash, and APT URL.
• Version 2.2.2
  • Updated the integration so that no records are discarded even if dates are not present when Discard data older than is set to All Time.
  • Fixed an issue that prevented APT feeds from being filtered correctly by date.
• Version 2.2.1
  • Updated the default setting for the Entries configuration parameter from 10,000 to 10,000,000.
  • Added configuration parameter, Discard Data Older Than, to discard data based on first_seen and last_seen to reduce load.
• Version 2.2.0
  • The integration can now ingest objects of the Malware family and relate it to indicators.
  • Removed Last seen attribute from indicators to avoid being duplicated with different values.
• Version 2.1.1
  • Fixed a relationship bug that would cause feed run performance issues.  
• Version 2.1.0
  • Refactored feeds.
  • Ensure all Indicators related to main pivot Indicators ingest with the Indirect status
  • Added object relations between main pivot Indicators and related Indirect Indicators.
  • Fixed a bug that caused relations to hash indicators to fail.
  • Added the following APT Feeds:
    • Kaspersky APT IPs
    • Kaspersky APT URLs
    • Kaspersky APT Hashes
  • Changed the status to Active for related indicators of type MD5, SHA-1, SHA-256.
  • Removed Kaspersky P-SMS Trojan feed.
• Version 1.2.0
  • Updated URL Feeds - .whois related indicators ingested as indirect
• Version 1.1.0
  • Added new feed to integration: Kaspersky ICS Hash Feed
• Version 1.0.0
  • Initial Release