Team Cymru Explains IP Tags for Threat-Intelligence Workflows
Summary
Team Cymru describes its IP-tagging taxonomy, which it says combines machine logic and analyst review, and shows how Scout and Recon users can filter flows, investigate C2 infrastructure, and correlate shared infrastructure.
Key points
- Team Cymru says its tags label observed IP addresses by behavior, infrastructure, or risk, using parent and child tags, tag families, and descriptors.
- The company says tags are generated through a combination of machine logic and review by its S2 Threat Research team.
- Scout users can view tags alongside flows and filter or pivot on them; the article also describes exporting tags to SIEM/SOAR pipelines.
- Recon can search IP behavior over the previous 90 days and filter by tag family or child tag.
- The article demonstrates using controller and malware-family tags, including DarkComet and Warzone, to investigate C2 infrastructure and identify related IPs.
- It describes correlating infrastructure using hosting and TLS fingerprint patterns and identifying overlaps between malware families or threat groups.
Article Details
- Topic
- Team Cymru Tags for classifying IP addresses and enriching threat intelligence investigations
Malware
DarkCometA Child Tag where applicable (e.g. darkcomet, af-south-1, mirai)MiraiA Child Tag where applicable (e.g. darkcomet, af-south-1, mirai)QuasarAnalysts can use Tags to trace back malware families like Warzone, Quasar, or XWorm.WarzoneAnalysts can use Tags to trace back malware families like Warzone, Quasar, or XWorm.XWormAnalysts can use Tags to trace back malware families like Warzone, Quasar, or XWorm.