Release Notes: Related Threat Context for Faster Than Ever SOC Triage and 590+ Coverage Updates

Security investigations often begin with a single suspicious IOC, but deciding what it means requires context. The more relevant intelligence analysts can connect to that finding, the better they can determine what deserves attention and what to do next.

October’s release introduces a new powerful capability in ANY.RUN’s Interactive Sandbox– Related Threat Context. Now SOCs and MSSPs can save more time by uncovering relevant IOC connections and unlocking investigative insight with less effort. By bringing relevant intelligence directly into the workflow, analysts can easily assess their findings and decide how to respond without switching between multiple sources.

The release also expands threat coverage and detection capabilities, improving visibility into emerging threats and malicious activity. Together, these updates help SOC and MSSP teams investigate more efficiently, reduce manual effort, and make better-informed decisions with greater confidence.

Product Updates

This month’s product updates help analysts connect individual indicators with the context needed to decide what to do next. Related Threat Context surfaces relevant intelligence directly in the Interactive Sandbox, while Threat Intelligence Lookup helps explore related infrastructure, observables, and threat activity.

Related Threat Context: A Major Upgrade That Makes Every SOC Investigation Faster and Smarter

An IOC is only the starting point. To decide what to do next, analysts need to know whether it has appeared in previous investigations, is associated with activity in their industry, or connects to known threats.

With the introduction of a major new update for SOCs and MSSPs – Related Threat Context, ANY.RUN’s Interactive Sandbox takes threat investigations a step further.

For the first time, analysts can discover relevant connections to an IOC directly within their analysis workflow, bringing previously scattered intelligence closer to the moment decisions need to be made.

See how Related Threat Context works in a live Sandbox analysis

Connecting IOCs to Three Sources of Intelligence

Related analyses bring together three sources of insight, connecting current findings with intelligence that can help shape the next step.

• Team Context: Discover previous team investigations involving the same IOC and build on existing findings instead of duplicating work.
• Industry Context: See whether the IOC has appeared in analyses associated with your industry. This anonymized information provides an additional signal for prioritization, not proof that your organization is being targeted. Available to eligible internal SOCs, but not MSSPs.
• ANY.RUN Threat Intelligence: Explore related analyses, samples, infrastructure, and known threat activity through ANY.RUN Threat Intelligence Lookup.

These connections give analysts a more direct way to compare current behavior with previous observations, uncover additional IOCs, and identify promising leads for further investigation.

From IOC Discovery to Confident SOC Decisions

Consider a Tier 1 analyst investigating a suspicious URL. The sandbox reveals malicious behavior, but the analyst still needs to decide whether to close the case, investigate further, enrich it with threat intelligence, or escalate it.

Related analyses add another layer to that decision. By surfacing previous team findings, relevant industry activity, and broader threat intelligence, they help SOCs and MSSPs assess what they have found without starting separate searches from scratch.

The benefits extend across the entire team. Tier 1 analysts gain more information for triage, incident responders and threat hunters get additional leads for deeper investigation, and team leaders can make better use of existing team knowledge and Tier 2 expertise.

Related Threat Context brings threat intelligence closer to the point of investigation, helping SOCs and MSSPs turn individual IOC findings into more informed decisions and actionable next steps.

Explore how Related analyses can strengthen your SOC’s response with deeper threat context.

Threat Coverage Updates

October also brings an expansion of detection coverage, with 591 new signatures in total:

• 157 behavioral signatures
• 428 Suricata rules
• 6 YARA rules

Together, these additions extend visibility across endpoint behavior, file activity, and network communications, helping analysts identify more of the activity uncovered during real-world investigations.

157 New Behavioral Signatures

The October behavioral coverage expands ANY.RUN’s ability to recognize malicious activity observed during sandbox analysis.

Behavioral signatures complement static indicators by focusing on what suspicious software actually does during execution. This gives analysts additional signals when investigating malware, delivery chains, and other activity where a single hash or filename may not tell the whole story.

Network detection receives the largest expansion this month, with 428 new Suricata rules covering suspicious traffic associated with malware, phishing, command-and-control activity, and emerging attack infrastructure.

Three additions stand out:

• Exvicy framework HTTP activity — SID 89004358: detects HTTP activity associated with the emerging Exvicy Clickfix MaaS platform, helping identify network activity tied to social engineering campaigns.
• CLOUDHAZE C2 activity — SIDs 81001806–81001809: tracks communication attempts from the Rust-based CLOUDHAZE backdoor to its command-and-control infrastructure.
• VlnkSync HTTP activity — SID 84004770: detects network activity associated with the VlnkSync Telegram credential stealer.

These rules add network-level visibility into threats that can otherwise be difficult to distinguish from legitimate traffic, giving analysts another source of evidence during investigation.

New in Threat Intelligence Reports: KernelReaper

In October, ANY.RUN published a new Threat Intelligence Report on KernelReaper, a destructive Windows malware that can disrupt boot processes, storage, recovery mechanisms, and security controls.

The report details its behavior before and during execution, traces six additional payloads connected to the same server, and examines the infrastructure linking the samples without assuming they belong to a single malware family or threat actor.

It also provides IOCs, YARA and Sigma rules, and detection insights to help security teams identify KernelReaper and investigate related activity.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence solutions used by more than 16,000 organizations and 700,000 security professionals worldwide.

The company’s Interactive Sandbox enables SOC teams, MSSPs, and enterprise security teams to safely analyze suspicious files, URLs, phishing pages, and malware while observing attack activity in real time. Analysts can examine processes, browser activity, network traffic, persistence, credential access, and other behaviors to understand what a threat is doing.

ANY.RUN Threat Intelligence extends that investigation by helping teams connect indicators with related infrastructure, samples, campaigns, and observed activity.

ANY.RUN’s SOC 2 Type II attestation demonstrates the focus on maintaining robust security controls and protecting customer data. By bringing behavioral analysis and up-to-date threat intelligence together, the company equips security teams to investigate suspicious activity, strengthen threat detection, and respond to threats before they escalate.