Not every IOC deserve to enter your internal MISP instance, for obvious quality reasons. But it may be usefull for you analyst to be able to do a broader research on IOC published online.
This tool allows you to qualify one or more potential malicious markers of different type (URL, MD5, SHA1, SHA256, SHA512, IPv4, IPv6, domain etc..). You can run this tool with a Gnu/Linux environement. The Windows compatibility is currently working in BETA version.
BTG was born from a need for Conix's collaborators. During their activities, SOC and DFIR analysts face off a lot of information and metadata of multiple nature that they must identify as malicious or not.
Many knowledge-bases of malicious known activity (aka IOC) are accessible online on various website like VirusTotal, ZeusTracker etc. SOC and CERT can also have their own internal database such as MISP.
Daily tasks for SOC and DFIR analysts is therefore marked out by the research of data like IP addresses, hashs, domains; on these private or public knowledge-bases; these are repetitive and time-consuming actions.
Thus CERT-Conix created a tool allowing analysts to qualify such elements searchling many sources.
DShield
Lehigh
Malekal
Malwaredomains
Malwaredomainlist
MalwareTeks
MISP (Malware Information Sharing Platform)
Tor exit nodes
OpenPhish
Palevo
VirusTotal
ZeusTracker
sudo pip install -r requirements
cp config.py.editme config.py
vim config.py
Activate and fill licence key for modules you need to use.
python BTG.py http://mydomain.com 1a72dca1f6a961f528007ef04b6959d8 45.34.191.173
- Lancelot Bogard
- Robin Marsollier