{"id":7277,"date":"2024-03-13T07:37:37","date_gmt":"2024-03-13T07:37:37","guid":{"rendered":"\/cybersecurity-blog\/?p=7277"},"modified":"2025-09-29T06:03:18","modified_gmt":"2025-09-29T06:03:18","slug":"how-we-process-iocs","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/how-we-process-iocs\/","title":{"rendered":"How We Process IOCs for ANY.RUN Threat Intelligence Lookup and Feeds"},"content":{"rendered":"\n

At ANY.RUN<\/a>, we’ve been developing our interactive online malware sandbox since 2016. Today, 400,000 security professionals use it to detonate files, analyze threats, and inspect phishing sites. <\/p>\n\n\n\n

This gives us a unique perspective \u2014 and our key advantage: we\u2019ve built a database that contains event\u2019s fields and IOCs with connections between all artifacts within a single analysis session. In October 2022, aiming to give our users a more powerful way to use this data, we launched TI Threat Intelligence Feeds, followed by the TI Lookup<\/a> portal, which we shipped in February. <\/p>\n\n\n\n

Read how we developed TI Lookup<\/a><\/p>\n\n\n\n

In this article, we’ll explain how these products can help you expand threat coverage or identify threats from isolated indicators \u2014 which no other security solution on the market might have access to. <\/p>\n\n\n\n

How ANY.RUN processes indicators <\/h2>\n\n\n\n

Our sandbox is interactive. This means malware actually executes within it, running through different stages, fetching payloads and encrypting files or stealing data. If it doesn’t self-execute, the analyst can manually trigger it through actions like entering a password in a locked .ZIP archive or solving a CAPTCHA on a phishing site to trigger download of a second-stage payload. <\/p>\n\n\n\n

This allows us to capture a holistic picture of indicators within each analysis session. We extract them from: <\/p>\n\n\n\n