topic Re: issue with malwaredomainlist.ip in General Topics

issue with malwaredomainlist.ip

mr.linus — Mon, 18 Apr 2016 14:09:59 GMT

Dear,

I added the "malwaredomainlist.ip" as miner.

This is working (shows that it has mined about 1500 IPs), but when I add the miner input to a ipv4 or domain aggregator I do not get any output...

Re: issue with malwaredomainlist.ip

lmori — Mon, 18 Apr 2016 14:59:23 GMT

Dear mr.linus,

malwaredomainlist.ip generates IPv4 addresses only, that's the reason domain aggregator does not accept any of the generated indicators. If you check the prototype for stdlib.aggregatorDomain you will see the inbound filters applied to all the indicators. These filters accept WITHDRAWS and indicators with type domain. Evertyhing else is dropped.

The IPv4 aggregator instead should accept, but again it depends on the prototype you used to create the aggregator. malwaredomainlist.ip provides C2 IPs, and the indictors are marked as "outbound". Please, could you check that the IPv4 aggregator accepts "outbound" indicators ? You can look at the inbound filters inside the prototype.

It would be a good idea to add a new miner to poll the CSV file provided by malwaredomainlist instead of the IP list. I have created an ER (#8) to track this.

Re: issue with malwaredomainlist.ip

lmori — Tue, 19 Apr 2016 08:29:03 GMT

I am also working on a tracing function, to let the admin trace the flow of indicators across the graph. Should happen in a week or two.