Combining Threat Intelligence Platforms & Sandboxes

Organizations have many tools when investigating cyber threats, but two stand out: Threat Intelligence Platforms (TIPs) and sandboxes.

Each solution provides distinct advantages, yet combining their capabilities can lead to a more practical approach to detecting, analyzing, and responding to threats that can save resources and improve operations.

Let’s look at the key benefits of integrating TIPs and sandboxes for organizations. 

What Are Sandboxes? 

Sandboxes offer virtual environments intended for isolated malware analysis. Analysts use them to execute potentially malicious software without exposing their systems to the risk of infection.

Sandbox analysis aims to study malware’s operation and understand its tactics, techniques, and procedures (TTPs), which is essential for developing effective countermeasures.  

One example of such a service is ANY.RUN’s cloud-based sandbox. It allows users to upload and analyze suspicious files and URLs in fully interactive Windows and Linux virtual machines (VMs).

Analyzers can gain a complete view of malware behavior, including network traffic, system changes, and exploited vulnerabilities, and collect indicators of compromise (IOCs). 

What are Threat Intelligence Platforms? 

Threat Intelligence Platforms are searchable platforms that contain processed threat data from various sources.

By aggregating information from open-source feeds, commercial threat intelligence providers, and internal security tools, TIPs grant security teams access to insights into current cyber threats’ nature, origin, and potential impact.

The goal of using a TIP is to find additional context information on threats using existing artifacts or indicators.  

For instance, Threat Intelligence Lookup is a TIP that runs on the data collected from millions of public malware analysis sessions launched by users of the ANY.RUN sandbox.

Thanks to this, in addition to the standard indicators, such as domains and file names, the platform provides users with advanced search capabilities, enabling them to search for information across command lines, network and registry events, processes, triggered Suricata rules, etc. 

Combining TIPs and Sandboxes for Maximized Security Efficiency 

Integrating Threat Intelligence Platforms and Sandboxes creates a robust security framework that offers several advantages: 

A Better Understanding of the Threat Landscape 

TIPs provide security teams with a wealth of information on known and emerging threats, while sandboxes offer deeper insights into malware behavior and tactics.

Thus, organizations can gain a holistic view of threats currently presenting a risk and address potential vulnerabilities. 

Faster Response to Incidents 

Sandboxes can extract IOCs that can then be correlated with a TIP’s threat intelligence database. A search can yield valuable context on the threat in the form of extra indicators and samples. In turn, this can speed up incident response, allowing security teams to set their priorities more accurately and minimize the potential damage caused by attacks. 

Ability to Proactively Hunt for Emerging Threats 

The combination of TIPs and sandboxes enables security teams to engage in proactive threat hunting, using the intelligence provided by TIPs to create customized sandbox environments to analyze potential threats. Organizations can stay one step ahead of attackers by studying the potential vulnerabilities targeted by new threats. 

Better Resource Management  

Combining TIPs and sandboxes lets organizations make more informed decisions about resource allocation, prioritizing their efforts based on the most pressing threats.

With this approach, security teams can maximize the impact of their resources, ensuring that they are deployed where they can have the most significant effect on an organization’s security posture. 

Using a TIP and Sandbox to Identify and Analyze Remcos 

Let’s imagine you, as a cybersecurity professional, receive an alert about a suspicious network connection coming from one of the devices in your organization’s network. 

You decide to employ a threat intelligence platform to investigate it further and determine whether this situation poses any risk to the company.  

You begin your investigation by entering the currently available information about the incident, the IP address and the destination port, and configure the search to cover a period of the last seven days. 

Thus, you put together the query presented in the image above. 

The platform returns a wealth of information related to the provided indicators, including a domain which is marked as malicious by the platform, as well as additional IPs, events, and files. 

Most importantly, the platform provides 95 malware analysis sessions (tasks) from the ANY.RUN sandbox where the IP and port were used, all of which have the Remcos tag that indicates the known remote access trojan (RAT). 

Thanks to the direct integration of the platform with the sandbox, you can explore any of these tasks further and study the execution process of Remcos, view details such as the TTPs used by attackers, network and registry activity, processes, and even the configuration of the malware. 

As a result, you successfully and quickly identify the malware family present on your organization’s network and collect extensive information on it by using the combination of the two tools, facilitating further response. 

Try Threat Intelligence Lookup and ANY.RUN Sandbox 

Threat investigations and malware analysis can be fast, simple, and affordable. Just let ANY.RUN show you how. 

Test all features of Threat Intelligence Lookup and ANY.RUN’s interactive sandbox as part of a personalized demo for your SOC/DFIR team.  You can schedule a call.