microsoft/mstic

Microsoft Threat Intelligence

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.

When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Legal Notices

Microsoft and any contributors grant you a license to the Microsoft documentation and other content in this repository under the Creative Commons Attribution 4.0 International Public License, see the LICENSE file, and grant you a license to any code in the repository under the MIT License, see the LICENSE-CODE file.

Microsoft, Windows, Microsoft Azure and/or other Microsoft products and services referenced in the documentation may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries. The licenses for this project do not grant you rights to use any Microsoft names, logos, or trademarks. Microsoft's general trademark guidelines can be found at http://go.microsoft.com/fwlink/?LinkID=254653.

Privacy information can be found at https://privacy.microsoft.com/en-us/

Microsoft and any contributors reserve all other rights, whether under their respective copyrights, patents, or trademarks, whether by implication, estoppel or otherwise.

mstic's Issues

Are you no longer maintaining RapidReleaseTI ?

https://github.com/microsoft/mstic/tree/master/RapidReleaseTI

Last updated four months ago. Microsoft published multiple analytic rules in Sentinel that use this list as basis for detection and they are increasingly firing off false positives.
Maybe update the list or deprecate the analytic rules in Sentinel relating to RapidTI rules?

My suggestion would be to change all those analytic rules to just use the ThreatIntelligenceIndicator table, and then CTI personnel can spend time maintaining all IOCs within the ThreatIntelligenceTable, which would typically be from MISP, TAXII servers etc.

Namechange to Nobelium indicators causing errors

Spelling of Nobelium has changed in the file name - Note - Double "L"
NEW - Indicators/May21-NOBELLIUM/May21NOBELLIUMIoCs.csv
PREVIOUS - Indicators/May21-NOBELIUM/May21NOBELIUMIoCs.csv

This is causing issues in rules linking to the raw content

Github actions bot might have stopped working

I believe the Github actions bot that updated the IP address ranges from Azure has stopped working correctly. The last time it was updated was 3 weeks ago, and previously it was updated every week.

https://github.com/microsoft/mstic/commits/master/PublicFeeds/MSFTIPRanges/ServiceTags_Public.json

I believe it has also stopped working in Sentinel repository.

Similar list for other known C2 channels?

Hi, really appreciate you maintaining this list, we use it in Sentinel analytic rules for alerting on NordVPN activity. I was wondering if you plan on creating similar lists for Telegram and CactusVPN servers ?

This repo is missing important files

There are important files that Microsoft projects should all have that are not present in this repository. A pull request has been opened to add the missing file(s). When the pr is merged this issue will be closed automatically.

Microsoft teams can learn more about this effort and share feedback within the open source guidance available internally.

Merge this pull request