Hunt Launches SQL Tool for Threat Hunting Across Six Security Data Sets
Summary
Hunt announced Hunt SQL, a tool for querying six security data sets—including malware, certificates, HTTP scans, phishing, open directories and honeypot activity—to support threat hunting and analysis.
Key points
- Hunt SQL lets researchers, analysts and threat hunters query Hunt data using SQL.
- The initial release covers HTTP, malware, certificates, honeypot activity, open directories and phishing.
- Example queries show how to investigate C2 servers, malware hosting, certificates, HTTP indicators, suspicious files, phishing sites and scanning activity.
- Hunt says its malware database contains confirmed C2 servers; its phishing database includes confirmed malicious URLs.
- The company offers access through a free demo.
Article Details
- Event Type
- Hunt announced the release of Hunt SQL, a SQL-based threat-hunting and analysis feature.
- Impact
- Researchers, analysts, and threat hunters can query six Hunt datasets covering HTTP activity, malware and confirmed C2 servers, certificates, honeypot activity, open directories, and phishing pages.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 175[.]136[.]232[.]226 | HTTP activity from this IP is shown with an X-Havoc header, which the article links to the Havoc malware family. |
| IPV4 | 47[.]121[.]120[.]18 | Identified in the article as an IP associated with an AsyncRAT server. |
| URL | hxxp[:]//117[.]235[.]35[.]158:57010/Mozi[.]m | Payload URL in a command associated with Mozi scanning activity observed by Hunt honeypots. |
Malware
AsyncRATBelow is a short example searching for AsyncRAT Server in subject common names.HavocStealc was followed closely by Havoc, Sliver and Metasploit.MoziIn this we have specified a HTTP path associated with Mozi, and utilized Hunt SQL to show the ASN's that have scanned for the path.Quasar RATBelow is a short example, searching for a JA4X value initially seen in a Quasar RAT certificate.SliverStealc was followed closely by Havoc, Sliver and Metasploit.StealCOrdering by most popular, we can observe that Stealc was the most popular malware hosted on Amazon.com, Inc.