Using Team Cymru’s Pure Signal Data for Threat Hunting in OpenCTI
Summary
Team Cymru describes using its Pure Signal data in OpenCTI through Scout connectors, with example queries for investigating VPN use, AnyDesk-tagged infrastructure and PiKVM devices, plus Playbooks for scheduled hunts and dashboards.
Key points
- The integration uses Scout enrichment and search connectors to make Pure Signal data available within OpenCTI.
- Scout enrichment can add port and banner data, ASN and country details, resolving domains, STIX relationships and behavioral tags to an IP observable.
- A sample query combines North Korea country or ASN data with an Astrill VPN tag to investigate communications involving VPN exit nodes; it is an example hunt, not a reported finding.
- Another example searches for AnyDesk-tagged IPs on ASN 20485 to investigate possible misuse of remote desktop tools.
- A PiKVM query demonstrates looking for tagged devices associated with specified ASNs.
- OpenCTI Playbooks can schedule queries to feed dashboards tracking infrastructure changes and threat indicators, including ransomware and malware-family activity.
Article Details
- Topic
- OpenCTI integration with Team Cymru Pure Signal data for threat hunting, enrichment, and infrastructure analysis.
Malware
BianLianof IPs associated with tools like "Cobalt Strike" alongside ransomware families like "Rhysida" and "BianLian," giving leaders a clear view of the threat landscape.Rhysidatrack the volume of IPs associated with tools like "Cobalt Strike" alongside ransomware families like "Rhysida" and "BianLian," giving leaders a clear view of the threat landscape.
Vendors
FiligranTeam Cymru’s integration with Filigran makes information from the Pure Signal™ data ocean accessible to analysts working in OpenCTI. This integration joins Team Cymru’s global visibility and context-rich telemetryTeam CymruTeam Cymru’s integration with Filigran makes information from the Pure Signal™ data ocean accessible to analysts working in OpenCTI. This integration joins Team Cymru’s global visibility and context-rich telemetry
Products
OpenCTIwith Filigran makes information from the Pure Signal™ data ocean accessible to analysts working in OpenCTI. This integration joins Team Cymru’s global visibility and context-rich telemetry data with the unifiedPure SignalTeam Cymru’s integration with Filigran makes information from the Pure Signal™ data ocean accessible to analysts working in OpenCTI. This integration joins Team Cymru’s global visibility and context-rich telemetryScoutThe integration allows analysts to carry out deep dives into targeted observables. By triggering the Scout Enrichment Connector on a single IP address, analysts can discover a deep, multi-faceted threat profile, turning