threat hunting •Oct 26, 20
Threat research from Craw Security
Practical research covering emerging malware, threat intelligence, malware analysis, IOC investigations, MITRE ATT&CK, ransomware behaviour, threat hunting and security operations.
Create actionable intelligence from suspicious files, hashes, IP addresses, domains, URLs, vulnerabilities, and other security indications.
The goal of ThreatFusionAI, an AI-powered cyber threat intelligence platform, is to speed up threat investigations for SOC teams, security analysts, threat hunters, researchers, and incident responders. You can find an indicator's reputation, malware behavior, associated infrastructure, threat relationships, MITRE ATT&CK activity, and potential threat actor connections by pasting it into a single search form.
Use a single threat intel platform to determine what an indicator is, if it is malicious, what it connects to, and where your investigation should move next rather than examining several security tools separately.
Threat intelligence turns unprocessed security data into knowledge that your security team can look into and take action on.
An odd IP address could be included in a firewall alert. A suspicious file hash could be included in an EDR alert. A fraudulent URL or domain may be the first step in a phishing inquiry.
These values don't offer much context on their own. When they are linked to malware samples, infrastructure, vulnerabilities, campaigns, attacker behavior, and other indicators of compromise in cyber security, their true worth becomes apparent.
By combining these solutions, ThreatFusionAI allows analysts to spend more time looking at threats and less time gathering data.
Every Cyber Attack leaves traces.
A malicious attachment has a file hash. Malware communicates with an IP address. That IP may host multiple domains. A malicious domain can distribute additional payloads. Exploitation may target a known CVE.
These traces become useful when they are correlated.
These are often called atomic indicators of compromise because they represent individual observable values that security tools can search, detect, block, or correlate.
Security teams do not suffer from a lack of security data. They suffer from too much disconnected data.
ThreatFusionAI uses automation and AI to correlate indicators, malware behavior, infrastructure relationships, threat actors, campaigns, and MITRE ATT&CK activity.
A single malware sample can communicate with multiple domains and IP addresses. Those indicators may already be connected with hundreds of other samples.
To enable analysts to transition from one indicator to the larger attack infrastructure, ThreatFusionAI automatically maps these relationships.
Not every indicator has the same investigative value.
The platform brings together reputation information, malware behavior, relationships, threat context, and attacker techniques to help analysts identify which findings deserve attention first.
An integrated AI assistant helps analysts understand investigation results in simplified language. Ask about malware behaviour, IOC relationships, threat actor attribution, MITRE ATT&CK techniques, investigation findings or how to interpret a report.
Where automation stops. Automation narrows the investigation. Analysts retain responsibility for the final judgment. We rank, score and connect.
Malware Analysis Without Switching Between Multiple Tools
ThreatFusionAI consolidates the investigation data that traditionally requires multiple tools: antivirus engines, sandbox environments, reputation databases, IOC extraction tools, threat intelligence feeds and manual research. More than 2.3 million samples have already been processed.
Start with a file hash, IP address, domain, URL, or CVE found in an alert, SIEM event, EDR detection, phishing investigation, or malware report.
ThreatFusionAI correlates available information from malware analysis, reputation intelligence, sandbox telemetry, antivirus results, OSINT sources, and existing platform relationships.
Malware rarely operates alone. A file may connect to an IP. That IP may resolve to several domains. Those domains may appear in other malware samples. ThreatFusionAI connects these relationships automatically.
Pivot between connected indicators and expand the investigation until you understand the wider threat.
Instead of treating different malware analysis tools as isolated sources, ThreatFusionAI focuses on correlation. Security analysts can investigate:
This moves an investigation from the basic question — is this file malicious? — to the comprehensive one: what infrastructure, behaviour, malware and threat activity connects to this file?
Each one has a page of its own, with the screenshots, the workflow and the detail that will not fit here.
Observed techniques, tactic coverage and candidate threat actors for a sample.
Read moreStart from one indicator and pivot through everything connected to it.
Read moreCredential exposure, leaked data and access brokering, tied back to the platform.
Read moreEnrich SIEM and EDR alerts before the block-or-monitor call, by API or by hand.
Read moreThe investigation looks different depending on what is being protected. These are the teams that get the most out of the platform.
Examine phishing infrastructure, malicious IP addresses, suspicious domains, malware, and threat actor activity directed at financial institutions.
In situations where reducing response time is crucial, expedite investigations into ransomware, malware, suspicious infrastructure, and IOCs.
Examine specific threats and contrast reported attacker activity with MITRE ATT&CK methodologies and recognized threat groups.
Investigate intelligence across multiple customers and integrate available capabilities into existing security workflows through the API.
Examine phishing infrastructure, malware, dubious domains, URLs, and other signs of fraud and credential-focused attacks.
Provide students, researchers, and security teams with an accessible platform for malware, IOC, and ATT&CK investigation.
One Threat Intel Platform. Multiple Investigation Workflows. Many security products answer only one question. ThreatFusionAI is designed to help analysts continue beyond the first verdict.
All from a single unified interface.
Submit a suspicious file hash, IP address, domain, URL, CVE, email or phone number and get the relevant security context from one interface.
Move from an individual IOC to connected malware, domains, infrastructure and related indicators, rather than treating each one separately.
Map observed malware activity to MITRE ATT&CK techniques and compare that behaviour with tracked threat actors, malware families and campaigns.
Craw Security supplies internal analysis and security research; MITRE ATT&CK the standardised attacker tactics and techniques; VirusTotal the malware and file reputation intelligence; sandbox telemetry the observed behaviour and extracted indicators; and OSINT feeds the open-source intelligence that enriches an investigation.
The right platform depends on your investigation volume, the intelligence sources you need, your integrations and how your analysts work. These are the capabilities worth checking when you compare the top threat intelligence platforms, and where to find each one in ThreatFusionAI.
In order to help analysts comprehend cyber dangers, a cyber threat intelligence platform gathers, arranges, correlates, and displays security intelligence. IOC investigation, malware analysis, relationship mapping, MITRE ATT&CK behavior, and threat actor correlation are the main areas of interest for ThreatFusionAI.
Security teams can look at suspicious indicators such as file hashes, IP addresses, domains, URLs, and vulnerabilities with the aid of a threat intel platform. This data is used by analysts for threat hunting, malware research, incident response, SOC investigations, and security monitoring.
ThreatFusionAI incorporates OSINT and public security intelligence into its analysis workflow, but the ThreatFusionAI platform itself should not be described as open-source software unless Craw Security separately releases its source code. It can, however, support teams looking to combine open source threat intelligence platform data with malware, IOC, and ATT&CK investigations.
ThreatFusionAI focuses on what happens after an IOC lookup. Analysts can investigate connected infrastructure, malware relationships, extracted indicators, MITRE ATT&CK behavior, and possible threat actor similarities instead of receiving only an isolated reputation result.
There is no single best threat intelligence platform for every security organization. Requirements differ between SOC teams, MSSPs, researchers, incident responders, and enterprises. ThreatFusionAI is designed for teams that need IOC correlation, malware intelligence, relationship mapping, ATT&CK analysis, and threat hunting from a unified interface.
ThreatFusionAI currently supports seven primary lookup types:
Available intelligence depends on the indicator type.
Yes, supported domain and URL intelligence can help analysts investigate suspicious websites and links during phishing, malware, and security investigations. The results should be considered security intelligence for investigation rather than a substitute for organizational security controls.
Available antivirus verdicts, observed activity, extracted IOCs, associated infrastructure, MITRE ATT&CK methods, and potential threat actor or malware-family correlations can all be included in a file analysis.
A popular knowledge base that describes attacker strategies and tactics based on actual adversary activity is the MITRE ATT&CK framework. It is used by security teams to categorize and share the methods used by attackers.
MITRE ATT&CK techniques and tactics explain how adversaries accomplish their goals during cyberattacks. ThreatFusionAI can assist analysts comprehend how a sample functions by linking observed malware activity with pertinent methodologies.
Adversarial tactics, including execution, persistence, privilege escalation, defensive evasion, credential access, discovery, lateral movement, command and control, exfiltration, and impact, are arranged according to tactical objectives in the ATT&CK matrix.
ThreatFusionAI can help analysts examine malware behavior and map available observations to ATT&CK techniques, which can support ransomware MITRE ATT&CK investigations and behavioral analysis.
Indicators of compromise in cyber security are observable values or evidence that may indicate malicious activity. Malicious hashes, IP addresses, domains, URLs, registry modifications, filenames, and network artifacts are typical examples.
Atomic indicators of compromise are individual values such as IP addresses, domains, URLs, and file hashes that can usually be searched or matched directly within security systems.
Copy a suspicious indicator from your SIEM alert and search it in ThreatFusionAI. You can then review available reputation intelligence, malware relationships, associated infrastructure, and other contextual information before deciding how to respond.
ThreatFusionAI can help investigate supported indicators obtained during dark web threat intelligence or external exposure investigations. Dedicated dark-web monitoring should only be represented as a ThreatFusionAI feature if that capability is specifically available in the platform.
The best threat intelligence feeds depend on the organization's requirements. Useful feeds should provide relevant, timely, contextualized, and actionable information rather than simply large volumes of indicators. ThreatFusionAI combines multiple intelligence sources with its own relationship and investigation workflow.
Yes. Supported browser-based investigation capabilities can also be integrated with security workflows through the ThreatFusionAI API, subject to the applicable account and access level.
Practical research covering emerging malware, threat intelligence, malware analysis, IOC investigations, MITRE ATT&CK, ransomware behaviour, threat hunting and security operations.
ThreatFusionAI brings threat intelligence, malware analysis, IOC correlation, MITRE ATT&CK mapping, threat hunting, and security intelligence together in one investigation workflow.
Start with one suspicious indicator and discover what it is really connected to.
