{"id":7020,"date":"2024-02-13T08:22:34","date_gmt":"2024-02-13T08:22:34","guid":{"rendered":"\/cybersecurity-blog\/?p=7020"},"modified":"2024-09-20T12:15:16","modified_gmt":"2024-09-20T12:15:16","slug":"ti-lookup-use-case","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/ti-lookup-use-case\/","title":{"rendered":"ANY.RUN TI Lookup: a Phishing Case Study"},"content":{"rendered":"\n

At ANY.RUN, we\u2019ve recently released<\/a> our new Threat Intelligence Lookup service.  <\/p>\n\n\n\n

This tool opens up incredible opportunities for leveraging our extensive threat intelligence database more effectively. In this article, we aim to demonstrate how our advanced search capabilities can help you respond to security incidents more quickly and accurately<\/strong>. <\/p>\n\n\n\n

In this article, we\u2019re going to walk you through a realistic example of a phishing attack<\/strong>. But before we dive into the specifics, let\u2019s quickly recap: what is ANY.RUN Threat Intelligence Lookup and who is this service for? <\/p>\n\n\n\n

What is ANY.RUN Threat Intelligence Lookup? <\/h2>\n\n\n\n

ANY.RUN Threat Intelligence Lookup is a contextual search service available online and through an API. It works by indexing and analyzing data from millions of public interactive analysis sessions, also called simply \u201ctasks,\u201d which our community of over 300,000 researchers and 300 enterprises runs in the ANY.RUN sandbox. <\/p>\n\n\n\n

The main goal of this tool is to help your security team connect an isolated indicator to a specific threat.<\/p>\n\n\n

\n
\"\"
Search results show that IP \u201c185.216.70.238\u201d  is linked to RisePro malware <\/figcaption><\/figure><\/div>\n\n\n

For example, if you spot an unfamiliar IP in your network logs, figuring out its nature might take a while. However, it’s likely that this IP has already been recorded in a sandbox task. By querying for this IP in the Threat Intelligence Lookup, you can quickly find linked analysis sessions. <\/p>\n\n\n\n

In many cases, this is enough to identify the malware family by name. You’ll also get related details such as ports, URLs, and file hashes in the search results. <\/p>\n\n\n\n\n

\n\n

\nANY.RUN Threat Intelligence: Search for linked IOCs using over 30 fields<\/span> \n<\/p>\n\n\nContact sales\n<\/a>\n<\/div>\n\n\n\n